fix(metrics): CPU-side scoring NaN/UB guards across PSNR/SSIM/MS-SSIM/ADM/CAMBI/MOTION

[lusoris]

Summary

Round-6 audit — 11 CPU-path scoring edge-case fixes:

• APSNR log10(0) (integer_psnr.c): guard sse[i]==0 (identical frames) → emit psnr_max[i]; bound loop to enable_chroma?3:1 planes; remove erroneous *2 in cap formula.
• MS-SSIM pow(neg,frac) NaN (ms_ssim.c): wrap l and c in fabs() before pow(), mirroring the existing guard for s.
• MS-SSIM size overflow (ms_ssim.c): (double)w * (double)h instead of (double)(w*h) — int32 overflow at widths > 46340.
• float SSIM/MS-SSIM convert_to_db (float_ssim.c, float_ms_ssim.c): guard score >= 1.0 → return max_db; log10(1−score) with score≥1 yields NaN.
• iqa assert abort (iqa/ssim_tools.c): replace assert(!args) with runtime if (args && !mr) return INFINITY; the assert fired on the Rouse MS-SSIM path.
• *ADM score_aim uninit (adm.c, integer_adm.c): add *score_aim = 1.0f in the den==0 branch; caller reads it unconditionally.
• float_adm harmonic mean NaN (float_adm.c): guard score+score_aim==0 → return 0.0 instead of 0/0 NaN through MAX().
• float_adm adm_skip_scale0 sentinel (float_adm.c): emit explicit 0.0 for scale-0 when skip flag is set, mirroring float_vif.c:296.
• MOTION wrong bilinear stride (motion.c): pass caller-supplied img1_stride/img2_stride to motion_scale_bilinear; recomputing from width ignores alignment padding.
• MOTION OOM crash (motion.c): NULL-guard both aligned_malloc calls; return motion_scale0 gracefully on OOM.
• CAMBI v_band_size overflow (cambi.c): compute in signed int; return -EINVAL with diagnostic when non-positive — prevents uint16_t wrap-to-~65535 and OOB writes.

ADR-0108 deliverables

• Research digest: no digest needed: targeted bug-fix cluster
• Decision matrix: no alternatives: only-one-way fixes (see ADR-1033 § Alternatives considered)
• AGENTS.md invariant: no rebase-sensitive invariants
• Reproducer: meson test -C build --suite=fast + run vmaf on identical ref/dist pair — should produce clamped PSNR not -Inf
• CHANGELOG fragment: changelog.d/fixed/1033-cpu-scoring-nan-ub-guards.md
• Rebase note: docs/rebase-notes.md top entry
• state.md update: T-CPU-SCORING-NAN-UB-GUARDS-2026-06-04 opened and tracked

Files changed

core/src/feature/{integer_psnr,ms_ssim,float_ssim,float_ms_ssim,adm,float_adm,integer_adm,motion,cambi}.c + iqa/ssim_tools.c + ADR-1033 + changelog fragment.

Notes

• DRAFT only — do not merge until CI is green.
• SKIP=semgrep-local used per CachyOS io_uring memlock exception (pre-existing project rule, see fix/semgrep-local-io-uring-memlock).
• Related: fix/r6-metric-scoring-guards (ADR-1024) covers APSNR + PSNR UB + ADM subset — this PR is a superset that covers all 11 remaining bugs.

🤖 Generated with Claude Code