From 74e1001646d2906cec717f4b48862ba6212927b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C5=91rinc?= <pap.lorinc@gmail.com>
Date: Wed, 28 Jan 2026 14:13:38 +0100
Subject: [PATCH 1/3] test: avoid strict-aliasing/alignment UB in unit tests

The unit tests were writing through typed pointers into byte storage:
- `cuckoocache_tests.cpp` casted `uint256::begin()` to `uint32_t*` and wrote words. This is strict-aliasing UB (and can be miscompiled under -O2). Replace with `WriteLE32()` stores into the byte buffer.
- `allocator_tests.cpp` casted an untyped `void*` allocation to `uint32_t*` and dereferenced it. This can be misaligned access UB on some platforms. Replace with `std::memcpy()` store/load.
---
 src/test/allocator_tests.cpp   |  9 +++++++--
 src/test/cuckoocache_tests.cpp | 29 +++++++++++++++++------------
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/src/test/allocator_tests.cpp b/src/test/allocator_tests.cpp
index 65a0629d9e82..f454bb49d887 100644
--- a/src/test/allocator_tests.cpp
+++ b/src/test/allocator_tests.cpp
@@ -5,6 +5,8 @@
 #include <common/system.h>
 #include <support/lockedpool.h>
 
+#include <cstdint>
+#include <cstring>
 #include <limits>
 #include <memory>
 #include <stdexcept>
@@ -220,8 +222,11 @@ BOOST_AUTO_TEST_CASE(lockedpool_tests_live)
     void *a0 = pool.alloc(16);
     BOOST_CHECK(a0);
     // Test reading and writing the allocated memory
-    *((uint32_t*)a0) = 0x1234;
-    BOOST_CHECK(*((uint32_t*)a0) == 0x1234);
+    uint32_t value = 0x1234;
+    std::memcpy(a0, &value, sizeof(value));
+    uint32_t read_value;
+    std::memcpy(&read_value, a0, sizeof(read_value));
+    BOOST_CHECK_EQUAL(read_value, value);
 
     pool.free(a0);
     try { // Test exception on double-free
diff --git a/src/test/cuckoocache_tests.cpp b/src/test/cuckoocache_tests.cpp
index 5c723596e77a..43418acb57b9 100644
--- a/src/test/cuckoocache_tests.cpp
+++ b/src/test/cuckoocache_tests.cpp
@@ -3,6 +3,7 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <cuckoocache.h>
+#include <crypto/common.h>
 #include <random.h>
 #include <script/sigcache.h>
 #include <test/util/random.h>
@@ -64,9 +65,10 @@ double test_cache(size_t megabytes, double load)
     uint32_t n_insert = static_cast<uint32_t>(load * (bytes / sizeof(uint256)));
     hashes.resize(n_insert);
     for (uint32_t i = 0; i < n_insert; ++i) {
-        uint32_t* ptr = (uint32_t*)hashes[i].begin();
-        for (uint8_t j = 0; j < 8; ++j)
-            *(ptr++) = m_rng.rand32();
+        unsigned char* const data = hashes[i].begin();
+        for (uint8_t j = 0; j < 8; ++j) {
+            WriteLE32(data + j * sizeof(uint32_t), m_rng.rand32());
+        }
     }
     /** We make a copy of the hashes because future optimizations of the
      * cuckoocache may overwrite the inserted element, so the test is
@@ -137,9 +139,10 @@ void test_cache_erase(size_t megabytes)
     uint32_t n_insert = static_cast<uint32_t>(load * (bytes / sizeof(uint256)));
     hashes.resize(n_insert);
     for (uint32_t i = 0; i < n_insert; ++i) {
-        uint32_t* ptr = (uint32_t*)hashes[i].begin();
-        for (uint8_t j = 0; j < 8; ++j)
-            *(ptr++) = m_rng.rand32();
+        unsigned char* const data = hashes[i].begin();
+        for (uint8_t j = 0; j < 8; ++j) {
+            WriteLE32(data + j * sizeof(uint32_t), m_rng.rand32());
+        }
     }
     /** We make a copy of the hashes because future optimizations of the
      * cuckoocache may overwrite the inserted element, so the test is
@@ -202,9 +205,10 @@ void test_cache_erase_parallel(size_t megabytes)
     uint32_t n_insert = static_cast<uint32_t>(load * (bytes / sizeof(uint256)));
     hashes.resize(n_insert);
     for (uint32_t i = 0; i < n_insert; ++i) {
-        uint32_t* ptr = (uint32_t*)hashes[i].begin();
-        for (uint8_t j = 0; j < 8; ++j)
-            *(ptr++) = m_rng.rand32();
+        unsigned char* const data = hashes[i].begin();
+        for (uint8_t j = 0; j < 8; ++j) {
+            WriteLE32(data + j * sizeof(uint32_t), m_rng.rand32());
+        }
     }
     /** We make a copy of the hashes because future optimizations of the
      * cuckoocache may overwrite the inserted element, so the test is
@@ -316,9 +320,10 @@ void test_cache_generations()
             inserts.resize(n_insert);
             reads.reserve(n_insert / 2);
             for (uint32_t i = 0; i < n_insert; ++i) {
-                uint32_t* ptr = (uint32_t*)inserts[i].begin();
-                for (uint8_t j = 0; j < 8; ++j)
-                    *(ptr++) = rng.rand32();
+                unsigned char* const data = inserts[i].begin();
+                for (uint8_t j = 0; j < 8; ++j) {
+                    WriteLE32(data + j * sizeof(uint32_t), rng.rand32());
+                }
             }
             for (uint32_t i = 0; i < n_insert / 4; ++i)
                 reads.push_back(inserts[i]);

From f52e1404212e058bea101be48164672e2ea5ab77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C5=91rinc?= <pap.lorinc@gmail.com>
Date: Wed, 28 Jan 2026 14:13:38 +0100
Subject: [PATCH 2/3] script,memusage,wallet: pass trivial scalars by value

Clean up pass-by-const-ref of fundamental types:
- `CScriptNum` `int64_t` ctor/operators and `serialize()` now take `int64_t` by value instead of `const int64_t&` (no logic change; avoids unnecessary references in a hot/consensus-adjacent header).
- `memusage::DynamicUsage()` overloads for built-in scalars/pointers take values by value (still always returns 0).
- `coinselection.cpp` loop index uses `size_t` by value instead of `const size_t&`.
---
 src/memusage.h               | 24 ++++++++++++------------
 src/script/script.h          | 22 +++++++++++-----------
 src/wallet/coinselection.cpp |  4 ++--
 3 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/src/memusage.h b/src/memusage.h
index 02691bb4b5b8..728edfefa677 100644
--- a/src/memusage.h
+++ b/src/memusage.h
@@ -28,18 +28,18 @@ namespace memusage
 static size_t MallocUsage(size_t alloc);
 
 /** Dynamic memory usage for built-in types is zero. */
-static inline size_t DynamicUsage(const int8_t& v) { return 0; }
-static inline size_t DynamicUsage(const uint8_t& v) { return 0; }
-static inline size_t DynamicUsage(const int16_t& v) { return 0; }
-static inline size_t DynamicUsage(const uint16_t& v) { return 0; }
-static inline size_t DynamicUsage(const int32_t& v) { return 0; }
-static inline size_t DynamicUsage(const uint32_t& v) { return 0; }
-static inline size_t DynamicUsage(const int64_t& v) { return 0; }
-static inline size_t DynamicUsage(const uint64_t& v) { return 0; }
-static inline size_t DynamicUsage(const float& v) { return 0; }
-static inline size_t DynamicUsage(const double& v) { return 0; }
-template<typename X> static inline size_t DynamicUsage(X * const &v) { return 0; }
-template<typename X> static inline size_t DynamicUsage(const X * const &v) { return 0; }
+static inline size_t DynamicUsage(int8_t) { return 0; }
+static inline size_t DynamicUsage(uint8_t) { return 0; }
+static inline size_t DynamicUsage(int16_t) { return 0; }
+static inline size_t DynamicUsage(uint16_t) { return 0; }
+static inline size_t DynamicUsage(int32_t) { return 0; }
+static inline size_t DynamicUsage(uint32_t) { return 0; }
+static inline size_t DynamicUsage(int64_t) { return 0; }
+static inline size_t DynamicUsage(uint64_t) { return 0; }
+static inline size_t DynamicUsage(float) { return 0; }
+static inline size_t DynamicUsage(double) { return 0; }
+template<typename X> static inline size_t DynamicUsage(X* const) { return 0; }
+template<typename X> static inline size_t DynamicUsage(const X* const) { return 0; }
 
 /** Compute the memory used for dynamically allocated but owned data structures.
  *  For generic data types, this is *not* recursive. DynamicUsage(vector<vector<int> >)
diff --git a/src/script/script.h b/src/script/script.h
index b06be9c975d3..fb730024d44e 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -235,7 +235,7 @@ class CScriptNum
  */
 public:
 
-    explicit CScriptNum(const int64_t& n)
+    explicit CScriptNum(int64_t n)
     {
         m_value = n;
     }
@@ -269,21 +269,21 @@ class CScriptNum
         m_value = set_vch(vch);
     }
 
-    inline bool operator==(const int64_t& rhs) const    { return m_value == rhs; }
-    inline auto operator<=>(const int64_t& rhs) const    { return m_value <=> rhs; }
+    inline bool operator==(int64_t rhs) const    { return m_value == rhs; }
+    inline auto operator<=>(int64_t rhs) const    { return m_value <=> rhs; }
 
     inline bool operator==(const CScriptNum& rhs) const { return operator==(rhs.m_value); }
     inline auto operator<=>(const CScriptNum& rhs) const { return operator<=>(rhs.m_value); }
 
-    inline CScriptNum operator+(   const int64_t& rhs)    const { return CScriptNum(m_value + rhs);}
-    inline CScriptNum operator-(   const int64_t& rhs)    const { return CScriptNum(m_value - rhs);}
+    inline CScriptNum operator+(   int64_t rhs)    const { return CScriptNum(m_value + rhs);}
+    inline CScriptNum operator-(   int64_t rhs)    const { return CScriptNum(m_value - rhs);}
     inline CScriptNum operator+(   const CScriptNum& rhs) const { return operator+(rhs.m_value);   }
     inline CScriptNum operator-(   const CScriptNum& rhs) const { return operator-(rhs.m_value);   }
 
     inline CScriptNum& operator+=( const CScriptNum& rhs)       { return operator+=(rhs.m_value);  }
     inline CScriptNum& operator-=( const CScriptNum& rhs)       { return operator-=(rhs.m_value);  }
 
-    inline CScriptNum operator&(   const int64_t& rhs)    const { return CScriptNum(m_value & rhs);}
+    inline CScriptNum operator&(   int64_t rhs)    const { return CScriptNum(m_value & rhs);}
     inline CScriptNum operator&(   const CScriptNum& rhs) const { return operator&(rhs.m_value);   }
 
     inline CScriptNum& operator&=( const CScriptNum& rhs)       { return operator&=(rhs.m_value);  }
@@ -294,13 +294,13 @@ class CScriptNum
         return CScriptNum(-m_value);
     }
 
-    inline CScriptNum& operator=( const int64_t& rhs)
+    inline CScriptNum& operator=( int64_t rhs)
     {
         m_value = rhs;
         return *this;
     }
 
-    inline CScriptNum& operator+=( const int64_t& rhs)
+    inline CScriptNum& operator+=( int64_t rhs)
     {
         assert(rhs == 0 || (rhs > 0 && m_value <= std::numeric_limits<int64_t>::max() - rhs) ||
                            (rhs < 0 && m_value >= std::numeric_limits<int64_t>::min() - rhs));
@@ -308,7 +308,7 @@ class CScriptNum
         return *this;
     }
 
-    inline CScriptNum& operator-=( const int64_t& rhs)
+    inline CScriptNum& operator-=( int64_t rhs)
     {
         assert(rhs == 0 || (rhs > 0 && m_value >= std::numeric_limits<int64_t>::min() + rhs) ||
                            (rhs < 0 && m_value <= std::numeric_limits<int64_t>::max() + rhs));
@@ -316,7 +316,7 @@ class CScriptNum
         return *this;
     }
 
-    inline CScriptNum& operator&=( const int64_t& rhs)
+    inline CScriptNum& operator&=( int64_t rhs)
     {
         m_value &= rhs;
         return *this;
@@ -338,7 +338,7 @@ class CScriptNum
         return serialize(m_value);
     }
 
-    static std::vector<unsigned char> serialize(const int64_t& value)
+    static std::vector<unsigned char> serialize(int64_t value)
     {
         if(value == 0)
             return std::vector<unsigned char>();
diff --git a/src/wallet/coinselection.cpp b/src/wallet/coinselection.cpp
index 192e49361a1c..8fbcbac6483e 100644
--- a/src/wallet/coinselection.cpp
+++ b/src/wallet/coinselection.cpp
@@ -191,7 +191,7 @@ util::Result<SelectionResult> SelectCoinsBnB(std::vector<OutputGroup>& utxo_pool
     }
 
     // Set output set
-    for (const size_t& i : best_selection) {
+    for (size_t i : best_selection) {
         result.AddInput(utxo_pool.at(i));
     }
     result.RecalculateWaste(cost_of_change, cost_of_change, CAmount{0});
@@ -517,7 +517,7 @@ util::Result<SelectionResult> CoinGrinder(std::vector<OutputGroup>& utxo_pool, c
         return max_tx_weight_exceeded ? ErrorMaxWeightExceeded() : util::Error();
     }
 
-    for (const size_t& i : best_selection) {
+    for (size_t i : best_selection) {
         result.AddInput(utxo_pool[i]);
     }
 

From 2b7b0758ec8c5118d9016ad26eca5cc1a915c92e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C5=91rinc?= <pap.lorinc@gmail.com>
Date: Wed, 28 Jan 2026 14:13:38 +0100
Subject: [PATCH 3/3] crypto: use unaligned SIMD pointer type for SHA-NI
 load/store

The SHA-NI implementation used `(__m128i*)` casts with `_mm_loadu_si128` and `_mm_storeu_si128`. Switch to `__m128i_u` (with a safe fallback typedef) so unaligned access is explicit and we avoid relying on type-punned SIMD pointer casts for these intrinsics.

No intended behavior or performance change.
---
 src/crypto/sha256_x86_shani.cpp | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/crypto/sha256_x86_shani.cpp b/src/crypto/sha256_x86_shani.cpp
index daccdc51638b..34435a8af0fd 100644
--- a/src/crypto/sha256_x86_shani.cpp
+++ b/src/crypto/sha256_x86_shani.cpp
@@ -16,6 +16,12 @@
 
 namespace {
 
+#if (defined(__GNUC__) || defined(__clang__)) && !defined(_MSC_VER)
+using m128i_u = __m128i_u;
+#else
+using m128i_u = __m128i;
+#endif
+
 alignas(__m128i) const uint8_t MASK[16] = {0x03, 0x02, 0x01, 0x00, 0x07, 0x06, 0x05, 0x04, 0x0b, 0x0a, 0x09, 0x08, 0x0f, 0x0e, 0x0d, 0x0c};
 alignas(__m128i) const uint8_t INIT0[16] = {0x8c, 0x68, 0x05, 0x9b, 0x7f, 0x52, 0x0e, 0x51, 0x85, 0xae, 0x67, 0xbb, 0x67, 0xe6, 0x09, 0x6a};
 alignas(__m128i) const uint8_t INIT1[16] = {0x19, 0xcd, 0xe0, 0x5b, 0xab, 0xd9, 0x83, 0x1f, 0x3a, 0xf5, 0x4f, 0xa5, 0x72, 0xf3, 0x6e, 0x3c};
@@ -68,12 +74,14 @@ void ALWAYS_INLINE Unshuffle(__m128i& s0, __m128i& s1)
 
 __m128i ALWAYS_INLINE Load(const unsigned char* in)
 {
-    return _mm_shuffle_epi8(_mm_loadu_si128((const __m128i*)in), _mm_load_si128((const __m128i*)MASK));
+    return _mm_shuffle_epi8(_mm_loadu_si128(reinterpret_cast<const m128i_u*>(in)),
+                            _mm_load_si128(reinterpret_cast<const __m128i*>(MASK)));
 }
 
 void ALWAYS_INLINE Save(unsigned char* out, __m128i s)
 {
-    _mm_storeu_si128((__m128i*)out, _mm_shuffle_epi8(s, _mm_load_si128((const __m128i*)MASK)));
+    _mm_storeu_si128(reinterpret_cast<m128i_u*>(out),
+                     _mm_shuffle_epi8(s, _mm_load_si128(reinterpret_cast<const __m128i*>(MASK))));
 }
 }
 
@@ -83,8 +91,8 @@ void Transform(uint32_t* s, const unsigned char* chunk, size_t blocks)
     __m128i m0, m1, m2, m3, s0, s1, so0, so1;
 
     /* Load state */
-    s0 = _mm_loadu_si128((const __m128i*)s);
-    s1 = _mm_loadu_si128((const __m128i*)(s + 4));
+    s0 = _mm_loadu_si128(reinterpret_cast<const m128i_u*>(s));
+    s1 = _mm_loadu_si128(reinterpret_cast<const m128i_u*>(s + 4));
     Shuffle(s0, s1);
 
     while (blocks--) {
@@ -137,8 +145,8 @@ void Transform(uint32_t* s, const unsigned char* chunk, size_t blocks)
     }
 
     Unshuffle(s0, s1);
-    _mm_storeu_si128((__m128i*)s, s0);
-    _mm_storeu_si128((__m128i*)(s + 4), s1);
+    _mm_storeu_si128(reinterpret_cast<m128i_u*>(s), s0);
+    _mm_storeu_si128(reinterpret_cast<m128i_u*>(s + 4), s1);
 }
 }