12. SVM, loaders, syscalls, and precompiles

12.1 Execution boundary

This chapter fixes the consensus-visible execution environment supplied to native programs and Solana BPF (SBF) programs. Section 12.8 defines the entire active SBF instruction set and the Solana-specific loader, memory, syscall, input, compute, and state rules; no external ISA document is normative.

[SOL-SVM-0001] For every executable program and input state accepted by this specification, an SVM implementation MUST produce the same instruction result, compute-unit consumption, account changes, return data, and consensus-visible error.

[SOL-SVM-0002] The runtime MUST select the accepted SBF versions, VM configuration, loader behavior, syscall registry, precompile set, compute schedule, stack-depth rule, and feature branches from the bank in which the instruction executes.

12.2 Program resolution and loading

A program account is resolved through the transaction key vector. A native builtin is owned by the Native Loader. An SBF program is owned by a supported BPF loader. Under the upgradeable loader, executable Program state refers to a distinct ProgramData account containing deployment metadata and program bytes.

Program selection is the pure protocol relation:

Normative algorithm.

ResolveProgram(bank_state, program_id, invoking_slot)
    -> Builtin(program_id, behavior)
     | Sbf(loader_id, program_bytes, deployment_slot,
           ProgramEnvironment(execution, loader_id, deployment_slot,
                              invoking_slot, feature_activation_history))
     | ProgramAccountNotFound
     | InvalidProgramForExecution
     | UnsupportedProgramId

ProgramEnvironment(mode, loader_id, deployment_slot, invoking_slot, feature_activation_history) is the pure selection of the accepted SBF versions, verifier rules, memory configuration, syscall set, and compute schedule. Mode is deployment while validating new bytes and execution while invoking stored bytes; the mode-specific and historically retained syscall differences are stated in Sections 12.8.5 and 12.8.7. No compiled artifact, cache generation, eviction event, or host execution engine is an input to either relation.

[SOL-SVM-0003] Before invocation, the runtime MUST require the program identifier to be present in the transaction’s instruction context and MUST reject a missing, unsupported-owner, invalid-state, or unloadable program without entering its code. The stored executable Boolean is passed through the ABI but is not an epoch-E invocation predicate.

[SOL-SVM-0004] A native-loader-owned program MUST dispatch to the builtin registered for that exact program identifier, while a supported BPF-loader-owned program MUST dispatch through its loader and the bank-selected SBF environment.

[SOL-SVM-0005] ResolveProgram MUST depend only on the invoking bank’s account state, program identifier, invoking slot, and feature activation history, and MUST return the same selected bytes, loader, environment, and error for equal inputs.

[SOL-SVM-0006] Loading an upgradeable program MUST validate the Program-to-ProgramData relationship and use the ProgramData version visible in bank state; it MUST NOT substitute a later deployment or a host-local artifact. A deployment, upgrade, or Core-BPF migration at slot d MUST NOT make the new bytes invocable until slot d+1, and MUST NOT use the old bytes during that delay.

A successful deploy or upgrade recorded at slot d sets deployment slot d and effective slot d+1. During the remainder of d, resolution of that program does not fall back to the previous bytes: an attempted invocation fails with InstructionError::UnsupportedProgramId. At slots at or above d+1, resolution uses the new bytes. A checked addition overflow for d+1 makes deployment invalid.

12.3 Instruction execution environment

[SOL-SVM-0007] The runtime MUST execute top-level instructions in message order, initialize each instruction from transaction account privileges and data, and stop the transaction at the first failed instruction.

[SOL-SVM-0008] Each invocation MUST begin with return data reset to empty for the invoked program and MUST expose only return data produced during the current invocation chain.

[SOL-SVM-0009] The compute meter MUST begin at the transaction’s sanitized compute-unit limit, charge native-program work, VM instructions, heap provisioning, memory operations, syscalls, CPI, and loader work according to the active schedule, and fail when a required charge exceeds the remaining units. Epoch-E precompile verification consumes zero execution-meter units; its declared signature count is charged through transaction fees and the Section 10.4.1 block-admission cost.

[SOL-SVM-0010] VM memory translation MUST enforce the address ranges, permissions, alignment, stack layout, heap size, and input mapping in Section 12.8. An invalid guest access MUST produce the specified VM or instruction error without host undefined behavior.

[SOL-SVM-0011] Program return status, VM fault, compute exhaustion, and loader/runtime failure MUST map to the protocol instruction-error domain before Chapter 11 applies transaction rollback.

12.4 Invocation stack and CPI

An instruction context contains ordered instruction accounts, program accounts, instruction data, stack height, and its position in the transaction instruction trace. CPI uses accounts already present in the transaction context; it does not load an arbitrary account by public key.

[SOL-SVM-0012] Invocation push MUST fail when it would exceed the maximum instruction-stack depth of 5.

[SOL-SVM-0013] Invocation push MUST reject reentrancy when the target program already appears earlier in the invocation stack, except that a program MAY directly invoke itself when it is also the immediate caller.

[SOL-SVM-0014] A CPI instruction MUST resolve every account meta and the callee program to accounts already present in the caller’s transaction instruction context, and a missing account or callee MUST fail the caller instruction.

[SOL-SVM-0015] CPI MUST NOT elevate a readonly caller account to writable and MUST NOT elevate a nonsigner caller account to signer unless the caller program derives that account as a valid program-derived address from supplied signer seeds.

[SOL-SVM-0016] Signer seeds MUST be interpreted under the caller program identifier, not the callee identifier, and invalid seed count, seed length, or derived-address construction MUST fail CPI.

[SOL-SVM-0017] A CPI MUST reject more than 255 account metas, more than 255 account-info records, more than 16 signer-seed groups, or instruction data longer than 10,240 bytes. The complete instruction trace, including top-level instructions, MUST NOT exceed 64 entries.

[SOL-SVM-0018] CPI MUST NOT directly target the Native Loader, a BPF loader, an active signature precompile, or an upgradeable-loader management instruction outside the active allowlist.

[SOL-SVM-0019] Before entering a callee and after returning to its caller, the runtime MUST synchronize every shared account’s lamports, data, owner, and permitted length changes without losing aliases or duplicate-account privileges.

[SOL-SVM-0020] Instruction pop MUST fail if an account remains borrowed or if aggregate lamports differ from the aggregate on instruction entry, and the resulting error MUST trigger transaction rollback.

12.5 Syscall dispatch

[SOL-SVM-0021] A syscall MUST resolve only when registered in the runtime environment for the bank and program deployment; an unresolved symbol or static target MUST cause ELF verification or execution failure.

[SOL-SVM-0022] Each syscall MUST translate and bounds-check guest pointers and lengths, enforce required alignment and non-overlap rules, validate selectors and numeric bounds, and charge its specified compute cost before producing an output or error.

[SOL-SVM-0023] A sysvar syscall MUST return the bank-visible value for the current invocation and slot and MUST NOT read host time or stale process-global state.

[SOL-SVM-0024] Hashing and elliptic-curve syscalls MUST operate on the exact guest byte slices and curve/field encodings selected by the syscall’s identifiers, with deterministic rejection of invalid encodings.

[SOL-SVM-0025] sol_memcpy_ MUST reject overlapping source and destination ranges; sol_memmove_ MUST permit overlap; sol_memset_ MUST write the low byte of its fill argument; and sol_memcmp_ MUST write the signed comparison result to its result pointer.

12.6 Signature precompiles

Precompiles are processed in top-level message order during instruction execution and can reference the complete ordered vector of top-level instruction data. They do not run SBF code and cannot be invoked by CPI. A precompile failure is an executed instruction error: the transaction fee remains charged and Chapter 11 rolls back program-produced state.

12.6.1 Ed25519 and secp256r1 record layout

Ed25519 and secp256r1 use a two-byte prefix followed by count consecutive 14-byte records. Every integer in a record is an unaligned little-endian u16.

Normative table.

Normative table.

For either precompile, instruction index 0xffff selects the current precompile instruction data; any other value selects that zero-based top-level instruction’s data.

Normative table.

12.6.2 secp256k1 record layout

The secp256k1 instruction begins with a one-byte count and count consecutive 11-byte records. The u16 fields are little-endian.

Normative table.

Normative table.

The referenced secp256k1 signature value has this layout:

Normative table.

Verification computes Keccak-256 over the referenced message, recovers the public key, serializes its 64-byte uncompressed coordinates without the SEC1 prefix, computes Keccak-256 again, and compares the last 20 bytes with the referenced Ethereum address. A zero count is valid only when the instruction contains exactly the count byte.

[SOL-SVM-0026] A precompile verifier MUST parse the applicable prefix and record table above, require the complete table to be present, bounds-check every referenced range with saturating or checked arithmetic, and apply the program-specific verification rule.

[SOL-SVM-0027] A malformed table, out-of-range instruction reference, invalid key or signature encoding, failed signature, or invalid count/data combination MUST fail that top-level instruction with the corresponding precompile instruction error, stop later instructions, and enter the failed-execution rollback path.

[SOL-SVM-0028] Precompile signature counts used for fee and block-admission cost calculation MUST be read from the same active program identifier and instruction bytes used by verification. Precompile verification itself MUST NOT debit the epoch-E transaction execution meter.

[SOL-SVM-0029] A precompile MUST observe only the ordered top-level instruction-data vector; CPI-created instruction data MUST NOT be substituted into that vector.

12.7 Protocol-visible execution errors

Every instruction failure is returned as TransactionError::InstructionError(i,e), where i is the zero-based top-level message-instruction index even when the failure arose in CPI and e is one exact value from the table below. It is outcome P2: the full fee and any durable-nonce advance commit, replay protection records the message, account writes roll back, consumed CU remains charged, and the failure is transaction-level rather than block-fatal. Logs and the final return-data buffer are not committed protocol outputs.

Normative table. Complete InstructionError domain and first applicable cause.

For an SBF EXIT at outer depth, r0 == 0 means success. A value v with upper 32 bits zero maps to Custom(u32(v)), except zero is success; Custom(0) is encoded by 1<<32. Builtin return codes (n<<32) map as follows.

Normative table. SBF builtin return-code mapping.

Any other value with nonzero upper 32 bits maps to InvalidError. Runtime postconditions are checked in transaction-account order; the first failing account and the first applicable row above determine e. Within a protocol program, instruction decoding precedes account acquisition, which precedes owner/state validation, signer/authority validation, numeric/rent validation, and mutation. Compute charged on entry or before a cryptographic operation is not refunded when a later check fails.

[SOL-SVM-0030] An implementation MUST preserve the protocol distinction among transaction sanitation/loading errors, instruction errors, custom program errors, VM faults, compute exhaustion, privilege escalation, unbalanced lamports, and invalid account-data or ownership transitions wherever that distinction affects replay or transaction status.

[SOL-SVM-0031] Diagnostic strings, host exception types, executable-preparation strategy, and performance metrics MAY differ, but they MUST NOT alter the error code, consumed compute, committed state, fee, or replay outcome. An implementation’s inability to prepare an SBF program that passes the normative verifier is a local failure, not InstructionError::ProgramFailedToCompile.

12.8 SBF abstract machine and runtime ABI

12.8.1 Complete active SBF instruction set

This subsection is the complete normative ISA for SBF V0 through V3 in epoch E. Names from BPF literature are mnemonics only; the byte, arithmetic, and version rules below are authoritative and an implementation does not need an external BPF specification.

[SOL-SVM-0032] An SBF engine MUST implement the SBF opcode, verifier, arithmetic, call, and VM-fault behavior selected by the ELF’s V0–V3 version and MUST NOT accept an instruction rejected by that version’s verifier.

Every ordinary instruction occupies eight bytes:

Normative table. SBF instruction word.

For versions that permit LDDW, it occupies two consecutive eight-byte words: the first word carries the low 32 immediate bits; the second word has opcode zero and carries the high 32 bits. No jump may target the second word.

Let D=r[dst], S=r[src], I=sign_extend_i32(imm), U32(x) be the low 32 bits interpreted unsigned, I32(x) those bits interpreted signed, and EA=r[base]+sign_extend_i16(off) modulo 2^64. Loads zero-extend the little-endian value read at EA; stores write the low 1, 2, 4, or 8 bytes. Every memory access is checked under Section 12.8.4 before it changes a register or byte. In the tables, an I/R opcode pair selects I with the first opcode and S with the second.

Normative table. Load and store opcodes.

All arithmetic wraps at its stated width. The 32-bit result is zero-extended except that in V0, V1, and V3 the results of add32, sub32, and mul32 are sign-extended from bit 31; V2 zero-extends those results. V2 defines immediate subtraction as I-D; every other version and every register subtraction uses D-X. A register shift uses U32(S) mod 32 or S mod 64; an immediate shift must be in 0..31 or 0..63 and otherwise fails verification.

Normative table. ALU opcodes and semantics.

For an immediate-form row, X=I, except V2 unsigned 64-bit PQR immediates use U32(imm). An immediate zero divisor is rejected by the verifier. A zero register divisor raises DivideByZero; signed MIN / -1 and MIN % -1 raise DivideOverflow. No destination is written on either VM fault; externally the transaction records InstructionError::ProgramFailedToComplete at the active instruction index and the ordinary VM-failure depletion rule in Section 12.8.9 applies.

Normative table. V2-only product, quotient, and remainder opcodes.

For a conditional jump, the taken target is pc+1+off; the fall-through is pc+1. Both are instruction-word indices. JA always takes its target. Unsigned and signed rows interpret operands at the width in the table.

Normative table. Control-flow opcodes.

For V0–V2 CALL imm, U32(imm) is the Murmur3-32 symbol key of either a loader-registered syscall or an internal function. For V3, src=0 selects a syscall by the same key, while src=1 selects the internal target pc+1+sign_extend_i32(imm); any other src is unresolved. CALLX takes its virtual target from register number imm in V0/V1, src in V2, and dst in V3; only r0..r9 are legal. A call pushes r6..r9, the frame pointer, and the return PC; EXIT pops that frame or terminates the program when depth is zero.

An unknown opcode, illegal version/opcode combination, invalid register, write to r10, invalid branch/call target, branch into an LDDW continuation, malformed LDDW, immediate zero divisor, invalid shift/endian immediate, or misaligned V1/V2 add64 r10,imm is rejected before execution. V1/V2 alone may write r10 with add64 r10,imm, and its immediate must be a multiple of 64.

Normative table. SBF machine limits.

12.8.2 Registers, calls, and exit

SBF register names use a lowercase r: r0 through r11. Indexed notation such as r[dst] denotes the register selected by an instruction field; uppercase symbols such as D and S denote values read from registers, not register names.

Normative table.

At program entry, all registers are zero except r1, r2, r10, and the internal r11. r1 is 0x0000000400000000, the start of serialized input. r2 is the virtual address of instruction data inside that input. r10 is the version-dependent initial stack pointer, and r11 identifies the ELF entry instruction.

[SOL-SVM-0033] Internal calls MUST preserve r6..r9, enforce call depth 64, and apply the selected version’s static-frame or dynamic-frame rule. A program exit with r0 == 0 is success; any other r0 MUST map through the canonical u64-to-InstructionError conversion.

12.8.3 Active SBF versions

The ELF64 e_flags field selects the SBF version: 0, 1, 2, or 3.

Normative table.

[SOL-SVM-0034] The runtime MUST select one version solely from e_flags, reject a version outside V0–V3, and apply that version consistently to ELF parsing, verification, calls, stack behavior, and execution.

12.8.4 Virtual address space

Virtual addresses use 32 low address bits within each 4-GiB region. Address translation, aligned mapping, version-specific stack-frame gaps, and instruction metering apply. Account data is part of the serialized-input region rather than a separate direct mapping.

Normative table.

The default heap is 32,768 bytes. A compute-budget instruction may select a 1,024-byte multiple from 32,768 through 262,144 bytes. Stack allocation is 64 * 4096 = 262144 bytes before version-specific gaps/mapping.

[SOL-SVM-0035] Every load, store, syscall pointer, and indirect call MUST translate entirely within a mapped region with the required access permission. Overflow, cross-region access, write to read-only memory, and unmapped access MUST fault deterministically.

12.8.5 ELF loading and verification

V0–V2 use the lenient parser and relocation path; V3 uses the strict parser. Common acceptance requires a 64-bit little-endian ELF for machine EM_BPF, an entry aligned to an eight-byte instruction, text length divisible by eight, a supported e_flags version, a resolvable entrypoint, no conflicting function hashes, and bytecode accepted by the requisite verifier.

The V3 strict image has this program-header contract:

Normative table.

The verifier rejects empty or non-eight-byte-multiple text, unknown opcodes, invalid registers, forbidden writes to r10, invalid immediate shift/endian/divisor values, malformed LDDW, jumps outside text or into an LDDW continuation, invalid CALLX registers, and immediate calls that do not resolve under the selected version.

[SOL-SVM-0036] Deployment and loading MUST reject an ELF that violates its version’s header, relocation, symbol, text, entrypoint, syscall-resolution, or bytecode-verification rule before it can execute.

12.8.6 Program input ABI

The deprecated loader uses ABI v0. The supported BPF Loader and Upgradeable BPF Loader use ABI v1. In both cases input begins at 0x400000000 with account_count:u64 in little-endian order. Duplicate account entries contain an index of the first occurrence and alias that occurrence.

ABI v1 nonduplicate account record:

Normative table.

An ABI v1 duplicate record has this layout:

Normative table.

After all account records, the input ends with:

Normative table.

ABI v0 uses this nonduplicate record and a one-byte duplicate record:

Normative table.

Normative table.

[SOL-SVM-0037] On successful VM exit, the runtime MUST deserialize only permitted lamport, owner, data-length, and data changes. ABI v1 growth MUST NOT exceed 10,240 bytes over the entry length or the system maximum account-data length; readonly, ownership, executable, rent, and lamport-conservation rules MUST be enforced before instruction success.

12.8.7 Active syscall ABI

Every SBF syscall receives up to five u64 arguments in r1..r5 and returns a u64 in r0, or raises a VM/syscall error. V0–V2 link external symbols by the 32-bit Murmur3-x86 hash with seed zero over the UTF-8 symbol bytes; V3 encodes the same hash statically in CALL imm with src=0. Every guest pointer and integer in the following structures is an eight-byte little-endian u64; Boolean fields are one byte and accept only 0 or 1. Thus the table’s hash is both the V0–V2 relocation key and the V3 static index.

Normative table. Common syscall guest structures.

For a Rust stable vector, capacity is not an accepted element count; it must be at least length. The address points to length consecutive elements of the applicable element size.

Normative table. Complete epoch-E syscall registry and register ABI.

Every row in this registry is available to a newly deployed V0, V1, V2, or V3 program in epoch E; the SBF version changes only whether the hash is resolved through an ELF relocation or a static call. All feature gates that introduce these rows are active at E, so no row has an additional per-program feature condition. Availability for an already deployed program is derived by ProgramEnvironment from its loader and deployment slot, the invoking slot, and feature activation history, as required by SOL-SVM-0039.

sol_blake3, sol_sha512, sol_big_mod_exp, sol_remaining_compute_units, and sol_get_fees_sysvar are not registered in the epoch-E environment. sol_alloc_free_ is not accepted in a new deployment; a program deployed under a retained historical environment may resolve it only as described below.

Before any dereference, address+length and descriptor-array multiplication are checked for u64/host-size overflow. An output must lie wholly in writable guest memory and every input wholly in readable guest memory. Typed u64, i32, descriptor, point, scalar, CPI, and sysvar pointers have their natural alignment; byte and public-key buffers have alignment one. With the active parameter-address restriction, fixed/generic sysvar destinations may not begin in the serialized-input region. With the active output-overlap rule, cryptographic, PDA, hash, and return-data output intervals must not overlap an input interval to the same call. CPI additionally pins every supplied key, owner, lamport, and data pointer to that account’s ABI address and requires its mutable data-length word to be outside serialized account memory.

The direct fixed-sysvar syscalls copy their in-memory repr(C) objects, not their compact account serializations.

Normative table. Direct-sysvar syscall C layouts.

These writes require natural alignment and are all-or-nothing.

Except for the documented sibling-header capacity update and operations whose purpose is memory copying, no syscall makes a partial output: it charges at the point specified in Section 12.8.8, validates selectors/counts and all input/output mappings, computes into temporary host state, then writes the complete result. An invalid pointer/alignment/overlap or arithmetic overflow raises a syscall-originated instruction error; an ordinary nonzero result in the table does not raise an instruction error.

The curve selectors and fixed operand representations are:

Normative table. Curve selectors and operands.

For group add and subtract, the left and right pointers each address one point. For multiply, the left pointer addresses one scalar and the right pointer one point. Curve25519 MSM addresses consecutive 32-byte scalars and points and accepts 0..=512 pairs. A successful curve operation returns 0; an invalid point or scalar returns 1; an unsupported selector is an invalid attribute. BLS little-endian encodes each 48-byte base-field element least significant byte first and orders each G2 extension element as c0,c1; big-endian reverses each base-field element and orders it as c1,c0.

BN254 sol_alt_bn128_group_op receives (selector,input_address,input_length,result_address). A BN254 G1 point is x[32] || y[32]; a G2 point is four 32-byte base-field elements. Big-endian G2 order is x.c1 || x.c0 || y.c1 || y.c0 as in EIP-197; little-endian order is x.c0 || x.c1 || y.c0 || y.c1. Each coordinate and scalar uses the selector’s byte order.

Normative table.

BN254 compression uses the same endian flag and independent base selectors:

Normative table.

Poseidon accepts only parameter ID 0 (BN254, x-to-the-fifth S-box), endian ID 0 for big-endian or 1 for little-endian, and at most 12 input descriptors. Every nonempty input is exactly 32 bytes and encodes a field element strictly below the BN254 scalar-field modulus; the result is exactly 32 bytes in the selected byte order. A zero-input or invalid-field invocation is charged and returns 1 with output unchanged.

[SOL-SVM-0038] Every active cryptographic syscall MUST enforce the selector, operand length, byte order, point/scalar validity, count limit, and output length in the tables above; it MUST NOT truncate an oversized operand or accept a noncanonical field encoding.

Programs deployed before the active disable_deploy_of_alloc_free_syscall boundary may retain sol_alloc_free_; its arguments are allocation size and free address, and a zero free address allocates from the 32-KiB bump heap.

[SOL-SVM-0039] ProgramEnvironment MUST select the syscall surface above for new deployments and derive the historically compatible surface for an already deployed program from protocol inputs. Only a program deployed before the active disable_deploy_of_alloc_free_syscall boundary may resolve sol_alloc_free_. Any other imported symbol MUST fail loading or resolution.

12.8.8 Compute schedule

The following active cost parameters are in compute units. A syscall consumes its charge with checked depletion before returning its result; any overrun is ComputationalBudgetExceeded. Variable-length operations use saturating arithmetic and the formulas in the syscall contract.

Normative table.

Native dispatch contributes to the same execution term X in Section 10.4.1. The fixed charge is consumed before the native instruction body returns, so an instruction error does not refund it. Any nested CPI, SBF execution, syscall, or explicitly additive operation is charged in addition:

Normative table.

The ZK ElGamal proof program has zero additional dispatch base and consumes the following instruction charge before proof verification or context closure:

Normative table.

Poseidon cost for n inputs is 61*n^2 + 542. MSM cost for positive length n is base + (n-1)*increment. BLS pairing costs 25,445 + 13,023*max(n-1,0). BN254 pairing, where n=floor(input_length/192), costs 36,364 + 12,121*max(n-1,0) + 85 + input_length + 32; a malformed nonmultiple length is still charged by that formula before returning failure. Each generic hash syscall accepts at most 20,000 slices, charges 85 once, then for each slice of length L charges max(10, floor(L/2)). BN254 compression costs 100 plus the applicable 30, 398, 86, or 13,610 row constant.

The byte-dependent and invocation charges are:

Normative table.

For one CPI with m account metas, i account-info records, instruction-data length D, and unique callee account-data lengths A_j, argument translation adds:

Normative algorithm.

floor(D / 250)
+ floor(34*m / 250)
+ floor(80*i / 250)
+ sum(floor(A_j / 250))

The 80-byte account-info term is the active accounting size, independent of whether the guest used the C or Rust descriptor. Duplicate instruction accounts do not repeat the A_j term. Callee instructions, heap provisioning, syscalls, and nested CPI continue to draw from the same meter. All divisions in this subsection are unsigned integer floor; all sums and products saturate unless a named operation requires checked failure.

Normative table. Syscall charge point and failure charging.

No validation failure refunds compute already consumed. A syscall that returns an ordinary nonzero status instead of raising an instruction error consumes the same charge as the corresponding successful selected operation.

[SOL-SVM-0040] The runtime MUST calculate and consume every native dispatch, SBF instruction, heap, syscall, memory, cryptographic, return-data, sysvar, and CPI charge exactly by the tables and formulas above. All such charges MUST draw from the same transaction compute meter, and the remaining units at every protocol-visible boundary MUST follow the same charge sequence.

12.8.9 Completion, deserialization, and failure

On an ordinary VM exception other than a syscall-originated instruction error, the active deplete_cu_meter_on_vm_failure rule consumes all remaining transaction compute. A syscall-originated instruction error retains the compute already charged by that path. Successful VM exit is not instruction success until parameter deserialization, account-change validation, lamport balance, borrow checks, and invocation-pop checks all succeed.

[SOL-SVM-0041] SBF execution MUST follow the abstract machine independently of the host execution strategy. An access fault, arithmetic fault, invalid call, call-depth failure, verifier escape, or compute exhaustion MUST NOT commit program writes; a nonzero exit status or post-execution account-validation failure MUST enter the same Chapter 11 rollback path.