Review coverage gaps left by the 2026-09-27 zkVM and rVM reports

[dendisuhubdy]

Both reports list what they did not cover; none is a finding, all remain unreviewed at v0.6:

• rVM DSL register allocator and replay, line by line (RVM-1a came from the allocator's spills).
• rVM cross-iteration analysis at the Production profile with N ≥ 2 (only N=1/Test was exercised). Related: ZKQ-5: rv32r self-verifier's binding is not tied to the inner aggregate's binding #44, AGG-E2E: end-to-end forged-aggregate exercise against the fixed rVM (before enabling aggregation) #45.
• Structured fuzzing of production and bundle proofs; SMT uniqueness of the zkVM ALU constraints.
• The GPU backend (rand-zkvm-cuda) and the sBPF/EVM translators (see also R4-a: gpu-kernels hands every thread a &mut over the whole buffer (aliasing UB) #49, R4-b: guest-sdk exposes safe fns that pass raw pointers to memory-writing syscalls #50).
• The viewing/note crypto (viewing::seal, ML-KEM envelopes, memo seal from v0.5.10).
• Live chain-15 data: which committed calls carried ≤ 31 private input words (exposed by COV-2 before the v0.6 floor) — a one-off scan on obs1 would say who is affected.

Close by assigning each to a review pass or recording it as accepted.

Sources: both reports' "What was not covered" sections.