By the time validate_vex() runs, e->s2 is not used anymore and
decode->op[2].ot has already been filled in by decode_size().
So it's the latter that has to be adjusted, just like before
commit b7d4ec4832d ("target/i386/tcg: move VEX validation early",
2026-08-26).

Fixes: b7d4ec4832d ("target/i386/tcg: move VEX validation early", 2026-08-26)
Reported-by: Zhao Liu <zhao1.liu@intel.com>
---
 target/i386/tcg/decode-new.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 8d1e581cfde..26f6d6277be 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2671,7 +2671,7 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
             }
             assert(e->op2 == X86_TYPE_W && e->s2 == X86_SIZE_x);
             if ((s->modrm >> 6) != 3) {
-                e->s2 = s->prefix & PREFIX_REPNZ ? X86_SIZE_sd : X86_SIZE_ss;
+                decode->op[2].ot = s->prefix & PREFIX_REPNZ ? MO_64 : MO_32;
             }
         }
         break;
-- 
2.55.0

On 9/23/26 05:47, Paolo Bonzini wrote:
> By the time validate_vex() runs, e->s2 is not used anymore and
> decode->op[2].ot has already been filled in by decode_size().
> So it's the latter that has to be adjusted, just like before
> commit b7d4ec4832d ("target/i386/tcg: move VEX validation early",
> 2026-08-26).
> 
> Fixes: b7d4ec4832d ("target/i386/tcg: move VEX validation early", 2026-08-26)
> Reported-by: Zhao Liu <zhao1.liu@intel.com>
> ---
>   target/i386/tcg/decode-new.c.inc | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
> index 8d1e581cfde..26f6d6277be 100644
> --- a/target/i386/tcg/decode-new.c.inc
> +++ b/target/i386/tcg/decode-new.c.inc
> @@ -2671,7 +2671,7 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
>               }
>               assert(e->op2 == X86_TYPE_W && e->s2 == X86_SIZE_x);
>               if ((s->modrm >> 6) != 3) {
> -                e->s2 = s->prefix & PREFIX_REPNZ ? X86_SIZE_sd : X86_SIZE_ss;
> +                decode->op[2].ot = s->prefix & PREFIX_REPNZ ? MO_64 : MO_32;
>               }
>           }
>           break;

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~