16-bit jmp decoded as 32-bit

[evmar]

Put \xe9\x75\xfe in the disassemble box, set x86 options to 16 bits, base address 0x100, click disassemble.

Expected: jmp 0xff78
Got: jmp 0xffffff78

[petabyt]

This seems to be a capstone bug:

int test_capstone(void) {
	csh handle;
	cs_insn *insn;
	size_t count;

	if (cs_open(CS_ARCH_X86, CS_MODE_16, &handle) != CS_ERR_OK)
		return -1;
	count = cs_disasm(handle, (uint8_t[]){0xe9, 0x75, 0xfe}, 3, 0x100, 0, &insn);
	if (count > 0) {
		size_t j;
		for (j = 0; j < count; j++) {
			printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic,
					insn[j].op_str);
		}

		cs_free(insn, count);
	} else
		printf("ERROR: Failed to disassemble given code!\n");

	cs_close(&handle);

    return 0;
}

0x100: jmp 0xffffff78

Tested against 5.0.9

[evmar]

It’s also possible I misunderstood what to expect here! Let me double check next time I am at a computer.

[evmar]

I tried iced-x86:

use iced_x86::{Decoder, DecoderOptions};

fn main() {
    let bytes = b"\xe9\x75\xfe";
    let decoder = Decoder::with_ip(
        /* bitness */ 16,
        bytes,
        /* ip */ 0,
        DecoderOptions::NONE,
    );
    for instr in decoder {
        println!("{instr}");
    }
}

prints

  jmp 0FE78h