fix(mem): vendor mimalloc 3.5.3 so free(NULL) before init is safe (supersedes #2562)

Makefile.cbm

@@ -45,8 +45,9 @@ endif
 
 # -Wdate-time: with -Werror, any use of __DATE__/__TIME__/__TIMESTAMP__ fails the
 # build. Build-time entropy is how one identical source tree produced a new hash
-# on every compile (see the local patch in vendored/mimalloc/src/options.c) —
-# once removed, it must not creep back through a new call site.
+# on every compile (mimalloc's version banner, patched locally until upstream
+# dropped the clock in v3.4.5; see vendored/mimalloc/PATCHES.md) — once
+# removed, it must not creep back through a new call site.
 CFLAGS_COMMON = -std=c11 -D_DEFAULT_SOURCE -D_GNU_SOURCE -Wall -Wextra -Werror \
                 -Wno-unused-parameter -Wno-sign-compare -Wdate-time \
                 $(GCC_ONLY_FLAGS) \
@@ -182,8 +183,9 @@ endif
 ifeq ($(IS_MINGW),yes)
 # --no-insert-timestamp: the PE header otherwise carries the link wall clock, so
 # two Windows builds of identical source are never byte-identical and every
-# release is a brand-new file to a reputation system. Same motivation as the
-# mimalloc __DATE__ patch; ELF and Mach-O have no equivalent field to clear.
+# release is a brand-new file to a reputation system. Same motivation as
+# dropping mimalloc's __DATE__ banner; ELF and Mach-O have no equivalent field
+# to clear.
 WIN32_LIBS := -lws2_32 -lpsapi -lshell32 -ladvapi32 -lbcrypt -Wl,--allow-multiple-definition -Wl,--stack,8388608 -Wl,--no-insert-timestamp -static
 endif
 
@@ -644,6 +646,18 @@ ifneq ($(filter yes,$(IS_MINGW) $(IS_LINUX)),)
 MIMALLOC_OVERRIDE_DEFINE := -DMI_MALLOC_OVERRIDE=1
 GLOBAL_OVERRIDE_DEFINE := -DCBM_MEM_GLOBAL_OVERRIDE=1
 endif
+# MI_MINGW_UCRT64: since 3.5.3, mimalloc treats a MinGW build as having a
+# process-attach hook only when this is defined (src/prim/windows/prim.c);
+# upstream's CMake sets it, this Makefile must too. Without it src/prim/prim.c
+# also compiles its constructor, so _mi_auto_process_init runs twice (that
+# constructor plus the CRT TLS callback) and the second options flush writes a
+# stray newline to stderr before main: a blank first line on every run, which
+# failed smoke-win's one-line --version check. Every MinGW toolchain we build
+# with (MSYS2 CLANG64/CLANGARM64) is UCRT. 3.3.2 had no such condition.
+MIMALLOC_WIN_DEFINE :=
+ifeq ($(IS_MINGW),yes)
+MIMALLOC_WIN_DEFINE := -DMI_MINGW_UCRT64=1
+endif
 # MI_DEBUG=0: the production allocator is mimalloc's RELEASE build. Its header
 # defaults to MI_DEBUG=2 unless NDEBUG is defined, and nothing here defined it,
 # so every shipped binary up to v0.11.0 ran mimalloc's debug build: internal
@@ -653,15 +667,19 @@ endif
 # work inside the allocator (2026-09-17). Committed-bytes accounting, which the
 # memory budget reads, is kept in every build (subproc stats, not MI_STAT).
 # The TEST build below keeps mimalloc's debug checks.
+# MI_PROFILE=0: mimalloc 3.5.2+ compiles its allocation-sampling profiler in by
+# default, which puts a sample countdown on the allocation path. The product
+# never uses it, so the production allocator leaves it out (the contract in
+# tests/test_prod_allocator_contract.sh checks the banner has no profiling line).
 MIMALLOC_CFLAGS = -std=c11 -O2 -w \
                   -Ivendored/mimalloc/include \
                   -Ivendored/mimalloc/src \
-                  -DMI_OVERRIDE=1 -DMI_DEBUG=0 \
-                  $(MIMALLOC_OVERRIDE_DEFINE)
+                  -DMI_OVERRIDE=1 -DMI_DEBUG=0 -DMI_PROFILE=0 \
+                  $(MIMALLOC_OVERRIDE_DEFINE) $(MIMALLOC_WIN_DEFINE)
 MIMALLOC_CFLAGS_TEST = -std=c11 -g -O1 -w \
                        -Ivendored/mimalloc/include \
                        -Ivendored/mimalloc/src \
-                       -DMI_OVERRIDE=0
+                       -DMI_OVERRIDE=0 $(MIMALLOC_WIN_DEFINE)
 
 # sqlite3 (vendored amalgamation — compiled ourselves for ASan instrumentation)
 # SQLITE_ENABLE_FTS5: enables the FTS5 full-text search extension used by the

THIRD_PARTY.md

@@ -121,10 +121,12 @@ License summary:
 | wyhash | `internal/cbm/vendored/wyhash/` | Unlicense (public domain) | [wangyi-fudan/wyhash](https://github.com/wangyi-fudan/wyhash) |
 
 Local modifications to these libraries are documented next to the
-vendored sources (currently only SQLite: `vendored/sqlite3/PATCHES.md`,
-raising the Unix VFS `MAX_PATHNAME` ceiling from 512 to 4096 to match
-CBM's 4 KiB path support). Patches must be reapplied on every upstream
-refresh and are covered by `scripts/vendored-checksums.txt`.
+vendored sources: `vendored/sqlite3/PATCHES.md` (raising the Unix VFS
+`MAX_PATHNAME` ceiling from 512 to 4096 to match CBM's 4 KiB path support)
+and `vendored/mimalloc/PATCHES.md` (the upstream source pin, mimalloc v3.5.3
+at commit `d4881d33`, plus the macOS decommit-recommit change and one comment
+rewording). Patches must be reapplied on every upstream refresh and are
+covered by `scripts/vendored-checksums.txt`.
 
 The graph-UI HTTP server is a first-party implementation
 (`src/ui/httpd.c` + `src/ui/http_server.c`) — no third-party HTTP library

scripts/ci/generate-sbom.py

@@ -40,7 +40,7 @@
     "packages": [
         {"SPDXID": "SPDXRef-Package-sqlite3", "name": "sqlite3", "versionInfo": "3.51.3", "licenseDeclared": "blessing", "downloadLocation": "https://sqlite.org", "filesAnalyzed": False},
         {"SPDXID": "SPDXRef-Package-yyjson", "name": "yyjson", "versionInfo": "0.12.0", "licenseDeclared": "MIT", "downloadLocation": "https://github.com/ibireme/yyjson", "filesAnalyzed": False},
-        {"SPDXID": "SPDXRef-Package-mimalloc", "name": "mimalloc", "versionInfo": "3.3.2", "licenseDeclared": "MIT", "downloadLocation": "https://github.com/microsoft/mimalloc", "filesAnalyzed": False},
+        {"SPDXID": "SPDXRef-Package-mimalloc", "name": "mimalloc", "versionInfo": "3.5.3", "licenseDeclared": "MIT", "downloadLocation": "https://github.com/microsoft/mimalloc", "filesAnalyzed": False},
         {"SPDXID": "SPDXRef-Package-xxhash", "name": "xxhash", "versionInfo": "0.8.3", "licenseDeclared": "BSD-2-Clause", "downloadLocation": "https://github.com/Cyan4973/xxHash", "filesAnalyzed": False},
         {"SPDXID": "SPDXRef-Package-tre", "name": "tre", "versionInfo": "0.8.0", "licenseDeclared": "BSD-2-Clause", "downloadLocation": "https://github.com/laurikari/tre", "filesAnalyzed": False},
         {"SPDXID": "SPDXRef-Package-tree-sitter", "name": "tree-sitter", "versionInfo": "0.24.4", "licenseDeclared": "MIT", "downloadLocation": "https://github.com/tree-sitter/tree-sitter", "filesAnalyzed": False},

scripts/test.sh

@@ -496,6 +496,14 @@ make -j"$NPROC" -f Makefile.cbm cbm TEST_SEAMS=1 ${MAKE_ARGS[@]+"${MAKE_ARGS[@]}
 WATCHDOG_BINARY="$ROOT/$BUILD_DIR/codebase-memory-mcp"
 CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_parent_watchdog.sh"
 
+# Step 5-alloc: the production allocator object Step 5 just built. The unit
+# suites link mimalloc's debug build without the global override, so they cannot
+# see free(NULL) before the allocator's constructor (mimalloc #1341, PR #2562)
+# or the vendored local patches; this links small fixtures against
+# prod_mimalloc.o itself.
+echo "=== Step 5-alloc: production allocator contract (mimalloc #1341 + local patches) ==="
+bash "$ROOT/tests/test_prod_allocator_contract.sh" "$ROOT/$BUILD_DIR"
+
 # Step 5a: that watchdog is also the SMALLEST-stack thread in the image, which
 # makes it the first casualty when static TLS grows — glibc takes the TLS block
 # out of each thread's own stack allocation. Checked here, against the binary

scripts/vendored-checksums.txt

@@ -992,50 +992,56 @@ a86b7735823b0408a4f3b922be86d4d25b6f4ab0dab32e03fb77246ca439dcf2  internal/cbm/v
 9b4bc8245565c98ccfc61c07749928b57e7c0f6fddb0530c4f6aa1971893d88b  internal/cbm/vendored/zstd/zstd.h
 66a8c3f71d12ea6e797e4f622f31f3f8f81c41b36f48cad4f5de7d8bfb6aac0a  internal/cbm/vendored/zstd/zstd_errors.h
 82ade5d7d9b029044b5fbbc326207fc47c2d44ee4dd71e8a559c36d728217de9  vendored/mimalloc/LICENSE
-dd4f25cae53209d45d73f8e6a2b9c219e8fc7434d97f20eba9af1a8b850030fd  vendored/mimalloc/include/mimalloc-new-delete.h
+edb95ac4f912bbcde6c1b658e147e757896c881eae249dbb5bbbae66ebdf6deb  vendored/mimalloc/PATCHES.md
+0a9c7e6daea2814876eab49697922f98b630c27ab9b089fbe4bd74f6e56edd68  vendored/mimalloc/include/mimalloc-new-delete.h
 21fcf61c4443341ac6bf6ea528af31dc7267e8e3456fc64bfd07704503032175  vendored/mimalloc/include/mimalloc-override.h
-5260df227ea1612b8678a06b063cc8f48e739b551554541cdeb4d430a7e257b3  vendored/mimalloc/include/mimalloc-stats.h
-869161433ab2d807a75752d0762accf5b68b6b24ce67e417af46bf181b9b6c72  vendored/mimalloc/include/mimalloc.h
-e9512b521a82cc0cbc262f6060dd70bb4243ac4a7d69d6ab8b1ef8e56f181a21  vendored/mimalloc/include/mimalloc/atomic.h
-57a7297e18ae464a7bfd3fc25a46229008602385697305c69ed289b89ece7631  vendored/mimalloc/include/mimalloc/bits.h
-5aeeff21d667daf4aadcc66f634aa957ecd688d15b277828f367c8c2274251a8  vendored/mimalloc/include/mimalloc/internal.h
-555302d2fcd05e974441d0c9c9208c26e860db4b3f17b9025a08f42e0f4807ba  vendored/mimalloc/include/mimalloc/prim.h
-1f378b4b6063c078d2aeb5d916c1d30b5db787a44ab9118e7daf673b086882c6  vendored/mimalloc/include/mimalloc/track.h
-b54e760da2a8d9d8a9cb708e280268c2d194c99bc518b21f72db70100578ad6a  vendored/mimalloc/include/mimalloc/types.h
-70420b4430da4bb6b5197fd27c6c0df485249c53a986bc9536c9fb643fc7613b  vendored/mimalloc/src/alloc-aligned.c
-6c8e9b0d042481c55791edb7330daec64bedaf26f0e70c9ca40de3cc17a690fe  vendored/mimalloc/src/alloc-override.c
-98d0eb877d7b9cdf7e9f857aaf3c739b69f746b91221e0e427e82bdd7cec90b3  vendored/mimalloc/src/alloc-posix.c
-a92d58e47220e5b6d138b83d92498771be4195ee59136a134e4461f6f726b9b8  vendored/mimalloc/src/alloc.c
-86fde644ede2e8d582e53499568a1713516a20326e0350eaa06a28029cece91b  vendored/mimalloc/src/arena-meta.c
-a1d6900d2b9a17461aa2a72a7791dfb22f6167b86f7ac6f15f981d9735aa2adb  vendored/mimalloc/src/arena.c
-de16033e029488e9ade4152ea1274e1a5ecbdc2c8a8d8ee50b745fd037ee6f6c  vendored/mimalloc/src/bitmap.c
-2e7a54ff44592a1fe8fe929e691322622f8aa1e0b1e80954781f332a88dd6cd1  vendored/mimalloc/src/bitmap.h
-c9a845dd7b9020f26d73761d235fb75e7bc4a3682576de750050ac4098211b43  vendored/mimalloc/src/free.c
-ae8e88737c9861e8e071fe5f1e7acc52093bcffd136a359a6b473101e968c14f  vendored/mimalloc/src/heap.c
-eca1fe77d72ab2aaccc447c8119056e9c4e8851bda9a95472b573539f76107ad  vendored/mimalloc/src/init.c
-ebd95b475f15d5387e6ef3c88a9cb47b88e64d7e55998ae1dc656614676a443b  vendored/mimalloc/src/libc.c
-192ce06ac9076445d223205fb340d8a1fc818dbf2b4c4a801dfd2c10bc6c1162  vendored/mimalloc/src/options.c
-011e965f28c0e2c885a6834d51bd756a458dd37ebfed6fd4d9ad6607ce0390ed  vendored/mimalloc/src/os.c
-1be3a208c678fc34187c2a8ffb75f3fe1eecc674bbf8b2af4d1f329506b1fad5  vendored/mimalloc/src/page-map.c
-7ec275805c9f00eb66710ffa99817b3ed1dba9826435d08f4866f7935152f6ae  vendored/mimalloc/src/page-queue.c
-d3614a59f2407a32e75b051deb1aff31b233f587d325dcc5420ba508551b687e  vendored/mimalloc/src/page.c
-7488e9e562ca85d2d757ec48e4d334935263a2333aa05b6061d8520f427c5890  vendored/mimalloc/src/prim/emscripten/prim.c
-ce14eb6dfd55f241095b55f70983931a2d92f7a6a622a9b360cdd70ab3b53208  vendored/mimalloc/src/prim/osx/alloc-override-zone.c
+c0aabbf2fbe54ce55e7dee23cb1891c2d65e0e1f5b18d9fe1a4e733c0c91d996  vendored/mimalloc/include/mimalloc-profile.h
+57aaf0b0db23521a32b0c6d7e0969e37ce69466fcfb0cb9b2d0114c2b56be182  vendored/mimalloc/include/mimalloc-stats.h
+8ec1bff9902bab6682e3ecbf7613ccc915e082ca743fdd0c396d3954323fe8bf  vendored/mimalloc/include/mimalloc.h
+7be611200328a99b052eda81abb8ad78b7e03446a0f6d302c1eb31cc9f096398  vendored/mimalloc/include/mimalloc/atomic.h
+1ecfb1bd1a7b6f73c335d21f3411c9ce0de3cbf6710e2d209e6cb6df2baf1ed3  vendored/mimalloc/include/mimalloc/bits.h
+26c10f7b990c51629618c74c64e3263a1fe00da787c2e72c56a79f87393f602c  vendored/mimalloc/include/mimalloc/internal.h
+a701ed0c182b4d0039bf683b4ac197011b8b794971a616c76ca64f036bc30d8b  vendored/mimalloc/include/mimalloc/prim-tls.h
+1987e8e2eedc07bb181bf2a11a27bec80a5309c32cfa66a56900fb4cbb64b172  vendored/mimalloc/include/mimalloc/prim.h
+31d94e981640bc4c340f21887610a9cd7242af4c5adc578f722ad03cb852db2e  vendored/mimalloc/include/mimalloc/track.h
+01abbaf1cc5572675b97f4115f205335e319b93249ee5163fb3bf2ad0fbbceae  vendored/mimalloc/include/mimalloc/types.h
+8390ff8d0e6c2954db1d95bfc1a4388b302605a1c5102c0495e5163838186e7f  vendored/mimalloc/src/alloc-aligned.c
+6576949f30978f3b7544d9696af12dac9615074a5c2fc05e3681475575bc6ca3  vendored/mimalloc/src/alloc-override.c
+a6dcdef4694964c972e6cf37f197f93c95f321566a3b5ccc1761129257255e93  vendored/mimalloc/src/alloc-posix.c
+e074a8a622f6317d42eb43e48db8cde3345696c96d6749523ef4fd58aeb55bb7  vendored/mimalloc/src/alloc.c
+27fce7003a5108fb9d0c61e92e0cd7870f687f7e3cf12ad19c7fb3954b2a0bc2  vendored/mimalloc/src/arena.c
+b33f7b220358667fb0eddcd6569ec7b79f7ef61daf08448c8448c8d1a8741b09  vendored/mimalloc/src/bitmap.c
+f3a9375ec0b56d515bea4b23732bf9a04964efecc516eb8aaac8b58ebf4512d9  vendored/mimalloc/src/bitmap.h
+56a1c57bd08c49359e19e8cdcd2a11b50c30bb12a53063375374fb3f5c8d6189  vendored/mimalloc/src/free.c
+a33d339568e5a7d16d6bae5650a79b1aef649e9b4ad0261be982580c2971eb64  vendored/mimalloc/src/heap.c
+1452ca684eca6d959eec9eae91750162f7738055f995bd4863f79b87aab88a8c  vendored/mimalloc/src/init.c
+b774d5750409006b690ab6262f037d78362ca978729314493636b358249e7fbd  vendored/mimalloc/src/libc.c
+5bfe80a0c473371d299840e8ed20831601d4998e4164e2e0bf71303697395824  vendored/mimalloc/src/options.c
+06b2d6d8a4cf3bfcc1822bb09aeaa4e7b741e7a5241f70b4f693b8038f455b00  vendored/mimalloc/src/os.c
+ff3509ae3d4185e9cb2a95e1f35daba3329e998bac917ac7938f1bf06dba0f78  vendored/mimalloc/src/page-map.c
+4128ca8b8d4df1116f73bf9a397903ca9941701c635345b1241295c3a31ff47d  vendored/mimalloc/src/page-queue.c
+ad0df1217e96669ef63539c345ea7dc4d637c3269be2d4de36ac3a5a42fb0c12  vendored/mimalloc/src/page.c
+896fc1016a26e10c6cf96259d0524c57e123ac9dcef1ba04f23d0add445286dd  vendored/mimalloc/src/prim/emscripten/prim.c
+502efbc8616f18be83713759438a0e5b8017ed215947ddfd48e74b85fd899114  vendored/mimalloc/src/prim/osx/alloc-override-zone.c
 247a9952465eb105be03a9962e922b085ce5d52034775551a61cd8594275be73  vendored/mimalloc/src/prim/osx/prim.c
-cc771788e5ba591efb681829a8724f8662a1f50f3db39cf5ebe7738b8ed57e44  vendored/mimalloc/src/prim/prim.c
-792531421c247fca0766ff7630057ec491173578ca4d1919ae34f05eb289ccf4  vendored/mimalloc/src/prim/readme.md
-20594d38ef4fc0c641f20a8664d17ee03ce195ca21b44e036f43cdb7bcd0bd0d  vendored/mimalloc/src/prim/unix/prim.c
-bee9c655a17e1e93bf4908e0a902fd3b566628447b1446fcbfa92bca2e76ca15  vendored/mimalloc/src/prim/wasi/prim.c
+884443f66808143d645dc6254c38e27f91b540a667ea23fe0ba1ef1caaf2b114  vendored/mimalloc/src/prim/prim-tls.c
+44419a450e742812d8f3c881d957bdd6cf18f40b90dfe1153084d2b64666f12d  vendored/mimalloc/src/prim/prim.c
+28510fce6710d7d08224135e2e986e85995d7907232d3d6e278a82213ca78935  vendored/mimalloc/src/prim/readme.md
+a5ce291e50e965fbeedc632f54bc9f10b78c0548cf7739cd477e21c6e2751b3a  vendored/mimalloc/src/prim/unix/prim.c
+2bc862cddb522314d58b3c6ef041e101c25cf04dfdda35cf78f91dbb6140cf46  vendored/mimalloc/src/prim/wasi/prim.c
 f70e61a1f2fe63da2f51c581895cf4a0918a9bffb0cf8600171f297141446962  vendored/mimalloc/src/prim/windows/etw-mimalloc.wprp
 4f3110ef2054c95cb275be96cb279224d3d46a728c5117bd1435425f382de778  vendored/mimalloc/src/prim/windows/etw.h
 445e6a70f9728fcc76a5ba52079336064d5e2257c2969023f1c64bf943776f54  vendored/mimalloc/src/prim/windows/etw.man
-5cde60fcef94cd79ab816030be00f8c1bdf18fab343563508c681ec6e762d1f1  vendored/mimalloc/src/prim/windows/prim.c
+41d96c081cbda6bcad0e8270eab7c3d69f94dfe3d3dcd8a9567569c595984cb0  vendored/mimalloc/src/prim/windows/prim.c
 1bcb43eef7fcddf6d8f18c6d5ee9bd350090ed183a1009d4f1c9b4d81a205bb9  vendored/mimalloc/src/prim/windows/readme.md
-a96a1acc75fd6595811b28420cf0495b87fac98c4dbc73aa0d742b6824f607c8  vendored/mimalloc/src/random.c
-4059be2a6676693be3433f5aedc711f56301772e65f3573654c236d6d1cfd074  vendored/mimalloc/src/static.c
-16825bbc252de422982b5728df7eda181d952824f5e3ce958c7fc85feae64b8e  vendored/mimalloc/src/stats.c
-7f76bcace4b0578f2063477752138adabd99f7b10a276998e296a312c47a7cfe  vendored/mimalloc/src/theap.c
-49be69a4b674e09690a63870830f3ffb05698ed4210949ef5add11957a08325b  vendored/mimalloc/src/threadlocal.c
+2bd12844f9de0392fdb00ea70f5ad15649ffd8e49f9a4d2388e15d6469a7b703  vendored/mimalloc/src/random.c
+4edc7700c2dd911cd03919d1098e973d887900ab08a5f41fd9648a79517fca57  vendored/mimalloc/src/sample-guarded.c
+3df74fee931244a302293f7d215dc87e3b5c120ab7df207edd92d0ff19eb3729  vendored/mimalloc/src/sample-profile.c
+fadfb75216098793f9f81e57d6ff3b63914084976526ed7867c9ca212825d784  vendored/mimalloc/src/static.c
+d78e0467008946b40d5356315a9ba76e04354ead65b1aafabbb7bd091c3826a6  vendored/mimalloc/src/stats.c
+41c147e8eb6e960687b79a201dd4498fb80f58923a0a4d73e04e80ef315b8eb6  vendored/mimalloc/src/subproc.c
+91271bc76502c743d109f32201c02271f63a9f6ec51ef207f8b533f6de39df27  vendored/mimalloc/src/theap.c
+01dbaacd5ac6685dc59c40d82a3f8932e5290d4d05f9a441424e4ea53e1ba973  vendored/mimalloc/src/threadlocal.c
 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  vendored/nomic/LICENSE
 893a74d9e3f0a74358344edc999e165739df343b36297967f3fd9cd462022f39  vendored/nomic/NOTICE
 dab3009c0d76b0c5e05ad8abc7c9f8f6effca547fea3c0394be96418a85c1081  vendored/nomic/code_tokens.h

tests/test_main.c

@@ -2122,7 +2122,49 @@ static int tf_role_dispatch(tf_phase_t phase, int argc, char **argv) {
 
 const char *cbm_test_program_path;
 
+#if defined(__has_feature)
+#if __has_feature(memory_sanitizer)
+#define TF_MSAN_MIMALLOC_OUTPUT 1
+#endif
+#endif
+
+#ifdef TF_MSAN_MIMALLOC_OUTPUT
+#include <mimalloc.h>
+#include <sanitizer/msan_interface.h>
+
+/* MSan lane only. mimalloc is deliberately left uninstrumented there
+ * (build/msan/mimalloc.o is compiled without -fsanitize=memory), so MSan never
+ * sees it write its own stack. Its text output is the one place those stack
+ * bytes reach an MSan interceptor: a message formatted in a mimalloc stack
+ * buffer arrives at fputs still carrying the shadow an earlier instrumented
+ * frame left there, and MSan reports initialized bytes as uninitialized.
+ * mimalloc 3.5.3 prints an arena-alignment fallback warning on the x86-64 MSan
+ * lane, which tripped this in the mem suite. Routing mimalloc's output through
+ * this handler marks the finished text initialized before it reaches fputs. */
+static bool tf_msan_mi_output_live;
+
+static void tf_msan_mi_output(const char *msg, void *arg) {
+    (void)arg;
+    /* Registering replays mimalloc's delayed-output buffer into the handler.
+     * Its constructor already wrote all of that to stderr before main, so the
+     * replay would only repeat it behind a stray newline: skip it. */
+    if (!tf_msan_mi_output_live || !msg) {
+        return;
+    }
+    /* Mark the text initialized before reading even its first byte. */
+    __msan_unpoison_string(msg);
+    if (!msg[0]) {
+        return;
+    }
+    (void)fputs(msg, stderr);
+}
+#endif
+
 int main(int argc, char **argv) {
+#ifdef TF_MSAN_MIMALLOC_OUTPUT
+    mi_register_output(tf_msan_mi_output, NULL);
+    tf_msan_mi_output_live = true;
+#endif
     cbm_test_program_path = tf_runner_image(argc, argv);
     int role_rc = tf_role_dispatch(TF_PHASE_RAW, argc, argv);
     if (role_rc >= 0) {