FA-81496 / MIDI event timing / Open access

Set Tempo meta event to BPM: declared length of the tempo event not checked · case 01

A malformed Set Tempo event declaring length 4 or 2 is accepted as if it were valid.

Verified by executionVariant 1 · 8 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The length byte of the meta event is not validated.

VERIFIED REPAIR

Restore the meta length byte step so that it reads `or x[2] != 3`.

Unsuccessful approach: Rejecting only lengths above three still accepts a declared length of two.

Case contract

Input the bytes of a Set Tempo meta event: FF 51 03 followed by a 24-bit big-endian microseconds-per-quarter value (nonzero). Return [microseconds, bpm_x100] where bpm_x100 = 6000000000 / microseconds rounded half up. Anything else returns None.

Why this case matters

MIDI sequencers, file readers and synth drivers depend on exact event ordering and tick/time arithmetic.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    if not isinstance(x, list) or len(x) != 6 or x[0] != 0xFF or x[1] != 0x51:
        return None
    us = (x[3] << 16) | (x[4] << 8) | x[5]
    if us == 0:
        return None
    centi = (12000000000 + us) // (2 * us)
    return [us, centi]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 3, 9, 39, 192], [600000, 10000]), ([255, 81, 3, 58, 152, 0], [3840000, 1563]), ([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 3, 2, 88, 0], [153600, 39063]), ([255, 81, 3, 0, 0, 1], [1, 6000000000]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None)], [([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 3, 2, 88, 0], [153600, 39063]), ([255, 81, 3, 0, 0, 1], [1, 6000000000]), ([255, 81, 3, 255, 255, 255], [16777215, 358]), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 0, 0], None), ([255, 82, 3, 7, 161, 32], None), ([255, 81, 3, 7, 161], None)], [([255, 81, 3, 255, 255, 255], [16777215, 358]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 0, 0], None), ([255, 82, 3, 7, 161, 32], None), ([255, 81, 3, 7, 161], None), ([255, 81, 3, 6, 26, 128], [400000, 15000]), ([255, 81, 3, 3, 13, 64], [200000, 30000])], [([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 7, 161], None), ([255, 81, 3, 6, 26, 128], [400000, 15000]), ([255, 81, 3, 3, 13, 64], [200000, 30000]), ([255, 81, 3, 0, 3, 232], [1000, 6000000]), ([255, 81, 3, 15, 66, 64], [1000000, 6000])], [([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 3, 9, 39, 192], [600000, 10000]), ([255, 81, 3, 58, 152, 0], [3840000, 1563]), ([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 3, 232], [1000, 6000000]), ([255, 81, 3, 15, 66, 64], [1000000, 6000])]]
for i, (args, expected) in enumerate(fixtures[N-1]):
    check("oracle %d" % i, solve(args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
oracle 0	`[500000, 12000]`	`[500000, 12000]`	Passed
oracle 1	`[600000, 10000]`	`[600000, 10000]`	Passed
oracle 2	`[3840000, 1563]`	`[3840000, 1563]`	Passed
oracle 3	`[768000, 7813]`	`[768000, 7813]`	Passed
oracle 4	`[153600, 39063]`	`[153600, 39063]`	Passed
oracle 5	`[1, 6000000000]`	`[1, 6000000000]`	Passed
oracle 6	`[500000, 12000]`	`None`	Failed
oracle 7	`[500000, 12000]`	`None`	Failed

SHA-256 / 00039af32c3a9fd942de0299db1134839b0f2b97f8bdc0995967ae8df6c9fef9

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    if not isinstance(x, list) or len(x) != 6 or x[0] != 0xFF or x[1] != 0x51 or x[2] > 3:
        return None
    us = (x[3] << 16) | (x[4] << 8) | x[5]
    if us == 0:
        return None
    centi = (12000000000 + us) // (2 * us)
    return [us, centi]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 3, 9, 39, 192], [600000, 10000]), ([255, 81, 3, 58, 152, 0], [3840000, 1563]), ([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 3, 2, 88, 0], [153600, 39063]), ([255, 81, 3, 0, 0, 1], [1, 6000000000]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None)], [([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 3, 2, 88, 0], [153600, 39063]), ([255, 81, 3, 0, 0, 1], [1, 6000000000]), ([255, 81, 3, 255, 255, 255], [16777215, 358]), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 0, 0], None), ([255, 82, 3, 7, 161, 32], None), ([255, 81, 3, 7, 161], None)], [([255, 81, 3, 255, 255, 255], [16777215, 358]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 0, 0], None), ([255, 82, 3, 7, 161, 32], None), ([255, 81, 3, 7, 161], None), ([255, 81, 3, 6, 26, 128], [400000, 15000]), ([255, 81, 3, 3, 13, 64], [200000, 30000])], [([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 7, 161], None), ([255, 81, 3, 6, 26, 128], [400000, 15000]), ([255, 81, 3, 3, 13, 64], [200000, 30000]), ([255, 81, 3, 0, 3, 232], [1000, 6000000]), ([255, 81, 3, 15, 66, 64], [1000000, 6000])], [([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 3, 9, 39, 192], [600000, 10000]), ([255, 81, 3, 58, 152, 0], [3840000, 1563]), ([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 3, 232], [1000, 6000000]), ([255, 81, 3, 15, 66, 64], [1000000, 6000])]]
for i, (args, expected) in enumerate(fixtures[N-1]):
    check("oracle %d" % i, solve(args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
oracle 0	`[500000, 12000]`	`[500000, 12000]`	Passed
oracle 1	`[600000, 10000]`	`[600000, 10000]`	Passed
oracle 2	`[3840000, 1563]`	`[3840000, 1563]`	Passed
oracle 3	`[768000, 7813]`	`[768000, 7813]`	Passed
oracle 4	`[153600, 39063]`	`[153600, 39063]`	Passed
oracle 5	`[1, 6000000000]`	`[1, 6000000000]`	Passed
oracle 6	`None`	`None`	Passed
oracle 7	`[500000, 12000]`	`None`	Failed

SHA-256 / de17dffbc4c42d6c11c469ba05eb0355646ac314eff1dc00b9244609b75e4381

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(x):
    if not isinstance(x, list) or len(x) != 6 or x[0] != 0xFF or x[1] != 0x51 or x[2] != 3:
        return None
    us = (x[3] << 16) | (x[4] << 8) | x[5]
    if us == 0:
        return None
    centi = (12000000000 + us) // (2 * us)
    return [us, centi]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 3, 9, 39, 192], [600000, 10000]), ([255, 81, 3, 58, 152, 0], [3840000, 1563]), ([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 3, 2, 88, 0], [153600, 39063]), ([255, 81, 3, 0, 0, 1], [1, 6000000000]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None)], [([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 3, 2, 88, 0], [153600, 39063]), ([255, 81, 3, 0, 0, 1], [1, 6000000000]), ([255, 81, 3, 255, 255, 255], [16777215, 358]), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 0, 0], None), ([255, 82, 3, 7, 161, 32], None), ([255, 81, 3, 7, 161], None)], [([255, 81, 3, 255, 255, 255], [16777215, 358]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 0, 0], None), ([255, 82, 3, 7, 161, 32], None), ([255, 81, 3, 7, 161], None), ([255, 81, 3, 6, 26, 128], [400000, 15000]), ([255, 81, 3, 3, 13, 64], [200000, 30000])], [([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 7, 161], None), ([255, 81, 3, 6, 26, 128], [400000, 15000]), ([255, 81, 3, 3, 13, 64], [200000, 30000]), ([255, 81, 3, 0, 3, 232], [1000, 6000000]), ([255, 81, 3, 15, 66, 64], [1000000, 6000])], [([255, 81, 3, 7, 161, 32], [500000, 12000]), ([255, 81, 3, 9, 39, 192], [600000, 10000]), ([255, 81, 3, 58, 152, 0], [3840000, 1563]), ([255, 81, 3, 11, 184, 0], [768000, 7813]), ([255, 81, 4, 7, 161, 32], None), ([255, 81, 2, 7, 161, 32], None), ([255, 81, 3, 0, 3, 232], [1000, 6000000]), ([255, 81, 3, 15, 66, 64], [1000000, 6000])]]
for i, (args, expected) in enumerate(fixtures[N-1]):
    check("oracle %d" % i, solve(args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
oracle 0	`[500000, 12000]`	`[500000, 12000]`	Passed
oracle 1	`[600000, 10000]`	`[600000, 10000]`	Passed
oracle 2	`[3840000, 1563]`	`[3840000, 1563]`	Passed
oracle 3	`[768000, 7813]`	`[768000, 7813]`	Passed
oracle 4	`[153600, 39063]`	`[153600, 39063]`	Passed
oracle 5	`[1, 6000000000]`	`[1, 6000000000]`	Passed
oracle 6	`None`	`None`	Passed
oracle 7	`None`	`None`	Passed

SHA-256 / 57ee6def152b87bdbbb6f331eb1a03fff3d30b15be8c4ebc6830ba190899f9ee

Verification & scope

A deterministic bounded teaching model with a stipulated toy contract; it is not a complete Standard MIDI File or MIDI 1.0/2.0 implementation. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:50:03.639390+00:00.

Case digest / 605521740b949bb717c59dc685590c34bf1b1eff2e7aa2d3b688b55ff69d6e4b