Differential Testing Exposes Native vs Generic XDP Behavior Gaps
An open-source differential harness compares native vs generic XDP frame bytes and verdicts, with a reproducible virtio/veth baseline on Linux 6.8.
The same BPF program can pass the verifier yet behave differently depending on whether the kernel runs it in native XDP or generic (SKB-mode) XDP. A newly released open-source differential test harness, paired with a fixed 11-packet corpus and a compare.py tool, checks both modes for agreement at the byte level and at the XDP verdict level (PASS/DROP/TX/REDIRECT). A tagged release makes the virtio/veth baseline reproducible on Linux 6.8.
The operational risk is concrete: a firewall or rate-limiter validated only under native XDP can silently fall back to generic mode on an unsupported driver, a veth port, or after a reload — same bytecode, different behavior, often with no clear error signal.
Running the harness across five BPF programs on the virtio_vm profile, all 11 test IDs paired cleanly on both backends with zero byte-level or verdict-level divergence — establishing that the harness itself is a valid measurement instrument before hunting for real divergences. Context metadata such as data_meta is not yet measured and is flagged as an observation limit reserved for a planned bare-metal follow-up.
This is part one of a two-part series that establishes the harness and its instrument-validity baseline; physical NIC results are explicitly out of scope here.