47 files changed, 851 insertions, 40 deletions

diff --git a/tests/Makefile b/tests/Makefile
index d19e3d8..1334efd 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -17,6 +17,7 @@ RUNTIME_TARGETS= \
         test_bzero_static_write       \
         test_compile                  \
         test_confstr_dynamic          \
+        test_confstr_static           \
         test_fgets_dynamic            \
         test_fgets_static             \
         test_fgetws_dynamic           \
@@ -39,7 +40,9 @@ RUNTIME_TARGETS= \
         test_getlogin_r_static        \
         test_memcpy_dynamic_read      \
         test_memcpy_dynamic_write     \
+        test_memcpy_overlap           \
         test_memcpy_static_read       \
+        test_memcpy_static_write      \
         test_memmove_dynamic_read     \
         test_memmove_dynamic_write    \
         test_memmove_static_read      \
@@ -50,14 +53,24 @@ RUNTIME_TARGETS= \
         test_mempcpy_static_write     \
         test_memset_dynamic_write     \
         test_memset_static_write      \
+        test_mbsnrtowcs_dynamic       \
+        test_mbsnrtowcs_static        \
+        test_mbsrtowcs_dynamic        \
+        test_mbsrtowcs_static         \
+        test_mbstowcs_dynamic         \
+        test_mbstowcs_static          \
         test_poll_dynamic             \
         test_poll_static              \
         test_ppoll_dynamic            \
         test_ppoll_static             \
+        test_pread_dynamic            \
+        test_pread_static             \
         test_read_dynamic             \
         test_read_static              \
         test_readlink_dynamic         \
         test_readlink_static          \
+        test_readlinkat_dynamic       \
+        test_readlinkat_static        \
         test_realpath_null            \
         test_realpath                 \
         test_recv_dynamic             \
@@ -68,12 +81,15 @@ RUNTIME_TARGETS= \
         test_send_static              \
         test_sendto_dynamic           \
         test_sendto_static            \
+        test_snprintf_dynamic         \
+        test_snprintf_static          \
         test_sprintf                  \
         test_sprintf_62               \
         test_stpcpy_dynamic_write     \
         test_stpcpy_static_write      \
         test_stpncpy_dynamic_write    \
         test_stpncpy_static_write     \
+        test_strcat_dynamic_write     \
         test_strcat_static_write      \
         test_strcpy_dynamic_write     \
         test_strcpy_static_write      \
@@ -82,24 +98,51 @@ RUNTIME_TARGETS= \
         test_strlcpy_dynamic_write    \
         test_strlcpy_static_write     \
         test_strncat_dynamic_write    \
+        test_strncat_n_eq_buf          \
+        test_strncat_n_gt_buf          \
+        test_strncat_n_lt_buf          \
+        test_strncat_n_one             \
+        test_strncat_safe              \
         test_strncat_static_write     \
         test_strncpy_dynamic_write    \
         test_strncpy_static_write     \
         test_swab_dynamic_read        \
         test_swab_dynamic_write       \
+        test_swab_negative            \
         test_swab_static_read         \
+        test_swab_static_write        \
         test_ttyname_r_dynamic        \
         test_ttyname_r_static         \
         test_vsnprintf_dynamic        \
         test_vsnprintf_static         \
         test_vsprintf                 \
+        test_wcrtomb                  \
+        test_wcsnrtombs_dynamic       \
+        test_wcsnrtombs_static        \
+        test_wcscat_dynamic_write     \
         test_wcscat_static_write      \
+        test_wcscpy_dynamic_write     \
         test_wcscpy_static_write      \
+        test_wcsncat_dynamic_write    \
+        test_wcsncat_n_eq_buf          \
+        test_wcsncat_n_gt_buf          \
+        test_wcsncat_n_lt_buf          \
+        test_wcsncat_n_one             \
+        test_wcsncat_safe              \
         test_wcsncat_static_write     \
+        test_wcsncpy_dynamic_write    \
         test_wcsncpy_static_write     \
+        test_wcsrtombs_dynamic        \
+        test_wcsrtombs_static         \
+        test_wcstombs_dynamic         \
+        test_wcstombs_static          \
+        test_wmemcpy_dynamic_read     \
         test_wmemcpy_dynamic_write    \
+        test_wmemcpy_static_read      \
         test_wmemcpy_static_write     \
+        test_wmemmove_dynamic_read    \
         test_wmemmove_dynamic_write   \
+        test_wmemmove_static_read     \
         test_wmemmove_static_write    \
         test_wmemset_dynamic          \
         test_wmemset_static           \
diff --git a/tests/test_confstr_static.c b/tests/test_confstr_static.c
new file mode 100644
index 0000000..f468532
--- /dev/null
+++ b/tests/test_confstr_static.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <unistd.h>
+
+int main(int argc, char** argv) {
+  char buffer[4] = {0};
+
+  confstr(_CS_PATH, buffer, 4);
+
+  CHK_FAIL_START
+  confstr(_CS_PATH, buffer, 8);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_mbsnrtowcs_dynamic.c b/tests/test_mbsnrtowcs_dynamic.c
new file mode 100644
index 0000000..b94ced5
--- /dev/null
+++ b/tests/test_mbsnrtowcs_dynamic.c
@@ -0,0 +1,26 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[4] = {0};
+  const char *src = "ABCDEFGHIJ";
+  const char *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  /* Safe: convert up to 2 source bytes into at most 2 wide chars */
+  srcp = src;
+  mbsnrtowcs(buffer, &srcp, 2, 2, &st);
+
+  /* Unsafe: ask to write argc (10) wide chars into 4-element buffer. */
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  mbsnrtowcs(buffer, &srcp, 10, argc, &st);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_mbsnrtowcs_static.c b/tests/test_mbsnrtowcs_static.c
new file mode 100644
index 0000000..40fe00a
--- /dev/null
+++ b/tests/test_mbsnrtowcs_static.c
@@ -0,0 +1,26 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[4] = {0};
+  const char *src = "ABCDEFGHIJKLMNOP";
+  const char *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  /* Safe: convert up to 4 source bytes into at most 2 wide chars */
+  srcp = src;
+  mbsnrtowcs(buffer, &srcp, 4, 2, &st);
+
+  /* Unsafe: ask to write 16 wide chars into 4-element buffer */
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  mbsnrtowcs(buffer, &srcp, 16, 16, &st);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_mbsrtowcs_dynamic.c b/tests/test_mbsrtowcs_dynamic.c
new file mode 100644
index 0000000..cbba0a3
--- /dev/null
+++ b/tests/test_mbsrtowcs_dynamic.c
@@ -0,0 +1,24 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[4] = {0};
+  const char *src = "ABCDEFGHIJ";
+  const char *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  srcp = src;
+  mbsrtowcs(buffer, &srcp, 2, &st);
+
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  mbsrtowcs(buffer, &srcp, argc + 15, &st);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_mbsrtowcs_static.c b/tests/test_mbsrtowcs_static.c
new file mode 100644
index 0000000..f90f29f
--- /dev/null
+++ b/tests/test_mbsrtowcs_static.c
@@ -0,0 +1,24 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[4] = {0};
+  const char *src = "ABCDEFGHIJ";
+  const char *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  srcp = src;
+  mbsrtowcs(buffer, &srcp, 2, &st);
+
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  mbsrtowcs(buffer, &srcp, 16, &st);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_mbstowcs_dynamic.c b/tests/test_mbstowcs_dynamic.c
new file mode 100644
index 0000000..4295fbd
--- /dev/null
+++ b/tests/test_mbstowcs_dynamic.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[4] = {0};
+
+  mbstowcs(buffer, "AB", 2);
+
+  CHK_FAIL_START
+  mbstowcs(buffer, "ABCDEFGHIJ", argc + 15);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_mbstowcs_static.c b/tests/test_mbstowcs_static.c
new file mode 100644
index 0000000..585c4f0
--- /dev/null
+++ b/tests/test_mbstowcs_static.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[4] = {0};
+
+  mbstowcs(buffer, "AB", 2);
+
+  CHK_FAIL_START
+  mbstowcs(buffer, "ABCDEFGHIJ", 16);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_memcpy_overlap.c b/tests/test_memcpy_overlap.c
new file mode 100644
index 0000000..f8c6639
--- /dev/null
+++ b/tests/test_memcpy_overlap.c
@@ -0,0 +1,27 @@
+#include "common.h"
+
+#include <string.h>
+
+/* fortify-headers' memcpy traps when src/dst overlap (but not when src == dst).
+ * This test exercises that overlap-detection branch, which is unique to this
+ * implementation. The pointer offset is hidden behind a volatile so -Wrestrict
+ * cannot see the overlap at compile time. */
+
+int main(int argc, char** argv) {
+  static char buffer[16] = "0123456789ABCDE";
+  volatile int off = 2; /* hidden from the compiler so -Wrestrict won't see */
+  char *p = buffer;
+  char *q = p + off;
+
+  /* dst == src: must NOT trap */
+  memcpy(p, p, 8);
+  puts(buffer);
+
+  /* Overlapping src/dst (dst < src): must trap */
+  CHK_FAIL_START
+  memcpy(p, q, 8);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_pread_dynamic.c b/tests/test_pread_dynamic.c
new file mode 100644
index 0000000..a04c661
--- /dev/null
+++ b/tests/test_pread_dynamic.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <unistd.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+
+  pread(0, buffer, 6, 0);
+
+  CHK_FAIL_START
+  pread(0, buffer, argc, 0);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_pread_static.c b/tests/test_pread_static.c
new file mode 100644
index 0000000..919fff7
--- /dev/null
+++ b/tests/test_pread_static.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <unistd.h>
+
+int main(int argc, char** argv) {
+  char buffer[12] = {0};
+
+  pread(0, buffer, 10, 0);
+
+  CHK_FAIL_START
+  pread(0, buffer, 14, 0);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_readlinkat_dynamic.c b/tests/test_readlinkat_dynamic.c
new file mode 100644
index 0000000..6976b74
--- /dev/null
+++ b/tests/test_readlinkat_dynamic.c
@@ -0,0 +1,17 @@
+#include "common.h"
+
+#include <fcntl.h>
+#include <unistd.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+
+  readlinkat(AT_FDCWD, "", buffer, 6);
+
+  CHK_FAIL_START
+  readlinkat(AT_FDCWD, "", buffer, argc);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_readlinkat_static.c b/tests/test_readlinkat_static.c
new file mode 100644
index 0000000..3331b1e
--- /dev/null
+++ b/tests/test_readlinkat_static.c
@@ -0,0 +1,17 @@
+#include "common.h"
+
+#include <fcntl.h>
+#include <unistd.h>
+
+int main(int argc, char** argv) {
+  char buffer[12] = {0};
+
+  readlinkat(AT_FDCWD, "", buffer, 10);
+
+  CHK_FAIL_START
+  readlinkat(AT_FDCWD, "", buffer, 14);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_select_dynamic.c b/tests/test_select_dynamic.c
deleted file mode 100644
index e67baf3..0000000
--- a/tests/test_select_dynamic.c
+++ /dev/null
@@ -1,16 +0,0 @@
-#include "common.h"
-
-#include <sys/select.h>
-
-int main(int argc, char** argv) {
-#if !defined(__clang__)
-  fd_set rfds;
-
-  CHK_FAIL_START
-  select(FD_SETSIZE + argc, &rfds, NULL, NULL, NULL);
-  CHK_FAIL_END
-
-  puts((const char*)&rfds);
-#endif
-  return ret;
-}
diff --git a/tests/test_select_static.c b/tests/test_select_static.c
deleted file mode 100644
index c2abf7f..0000000
--- a/tests/test_select_static.c
+++ /dev/null
@@ -1,16 +0,0 @@
-#include "common.h"
-
-#include <sys/select.h>
-
-int main(int argc, char** argv) {
-#if !defined(__clang__)
-  fd_set rfds;
-
-  CHK_FAIL_START
-  select(1337, &rfds, NULL, NULL, NULL);
-  CHK_FAIL_END
-
-  puts((const char*)&rfds);
-#endif
-  return ret;
-}
diff --git a/tests/test_snprintf_dynamic.c b/tests/test_snprintf_dynamic.c
new file mode 100644
index 0000000..e5f8fcc
--- /dev/null
+++ b/tests/test_snprintf_dynamic.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <stdio.h>
+
+int main(int argc, char** argv) {
+#if !defined(__clang__)
+  char buffer[8] = {0};
+  snprintf(buffer, sizeof(buffer), "%s", "1234567");
+  puts(buffer);
+
+  CHK_FAIL_START
+  snprintf(buffer, sizeof(buffer) + argc + 3, "%s", "1234567890");
+  CHK_FAIL_END
+
+  puts(buffer);
+#endif
+  return ret;
+}
diff --git a/tests/test_snprintf_static.c b/tests/test_snprintf_static.c
new file mode 100644
index 0000000..d3df447
--- /dev/null
+++ b/tests/test_snprintf_static.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <stdio.h>
+
+int main(int argc, char** argv) {
+#if !defined(__clang__)
+  char buffer[8] = {0};
+  snprintf(buffer, sizeof(buffer), "%s", "1234567");
+  puts(buffer);
+
+  CHK_FAIL_START
+  snprintf(buffer, sizeof(buffer) + 4, "%s", "1234567890");
+  CHK_FAIL_END
+
+  puts(buffer);
+#endif
+  return ret;
+}
diff --git a/tests/test_stpncpy_static_write.c b/tests/test_stpncpy_static_write.c
index 4bf9092..d4202ba 100644
--- a/tests/test_stpncpy_static_write.c
+++ b/tests/test_stpncpy_static_write.c
@@ -4,7 +4,8 @@
 
 int main(int argc, char** argv) {
   char buffer[8] = {0};
-  stpncpy(buffer, "1234567", 5);
+  stpncpy(buffer, "1234567890", 5);
+  stpncpy(buffer, "1234567890", 8);
   puts(buffer);
 
   CHK_FAIL_START
diff --git a/tests/test_strcat_dynamic_write.c b/tests/test_strcat_dynamic_write.c
new file mode 100644
index 0000000..dde9e44
--- /dev/null
+++ b/tests/test_strcat_dynamic_write.c
@@ -0,0 +1,15 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  strcat(buffer, "12345");
+
+  CHK_FAIL_START
+  strcat(buffer, argv[1]);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_strncat_dynamic_write.c b/tests/test_strncat_dynamic_write.c
index d5c5a94..c538339 100644
--- a/tests/test_strncat_dynamic_write.c
+++ b/tests/test_strncat_dynamic_write.c
@@ -7,11 +7,9 @@ int main(int argc, char** argv) {
   strncat(buffer, "1234567", 5);
   puts(buffer);
 
-#if 0
   CHK_FAIL_START
   strncat(buffer, argv[1], argc);
   CHK_FAIL_END
-#endif
 
   puts(buffer);
   return ret;
diff --git a/tests/test_strncat_n_eq_buf.c b/tests/test_strncat_n_eq_buf.c
new file mode 100644
index 0000000..bbc39d2
--- /dev/null
+++ b/tests/test_strncat_n_eq_buf.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  strncat(buffer, "12345", 5);
+  puts(buffer);
+
+  /* n == buffer size but overflow due to existing content.
+   * buffer has 5 chars, src "ABC" (len 3): 5+3+1 = 9 > 8 → overflow. */
+  CHK_FAIL_START
+  strncat(buffer, "ABC", 8);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_strncat_n_gt_buf.c b/tests/test_strncat_n_gt_buf.c
new file mode 100644
index 0000000..cca226b
--- /dev/null
+++ b/tests/test_strncat_n_gt_buf.c
@@ -0,0 +1,17 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  strncat(buffer, "12345", 5);
+  puts(buffer);
+
+  /* n > buffer size and overflow: n=10, buffer has 5 chars. */
+  CHK_FAIL_START
+  strncat(buffer, "1234567890", 10);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_strncat_n_lt_buf.c b/tests/test_strncat_n_lt_buf.c
new file mode 100644
index 0000000..35a0ba1
--- /dev/null
+++ b/tests/test_strncat_n_lt_buf.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  strncat(buffer, "12345", 5);
+  puts(buffer);
+
+  /* n < buffer size but overflow due to existing content.
+   * buffer has 5 chars, src "ABCD" (len 4), min(4,3)=3: 5+3+1 = 9 > 8. */
+  CHK_FAIL_START
+  strncat(buffer, "ABCD", 3);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_strncat_n_one.c b/tests/test_strncat_n_one.c
new file mode 100644
index 0000000..fce46bd
--- /dev/null
+++ b/tests/test_strncat_n_one.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  strncat(buffer, "1234567", 7);
+  puts(buffer);
+
+  /* n=1, buffer has 7 chars ("1234567").
+   * 7+1+1 = 9 > 8 → overflow. Even n=1 can overflow a nearly-full buffer. */
+  CHK_FAIL_START
+  strncat(buffer, "X", 1);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_strncat_safe.c b/tests/test_strncat_safe.c
new file mode 100644
index 0000000..ff8cadd
--- /dev/null
+++ b/tests/test_strncat_safe.c
@@ -0,0 +1,34 @@
+#include "common.h"
+
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+
+  /* Safe: empty buffer, append 7 chars with n=7 → "1234567\0" = exactly 8 bytes */
+  strncat(buffer, "1234567", 7);
+  puts(buffer);
+
+  /* Safe: reset and append with n larger than source.
+   * src is "AB" (len 2), n=100 → only 2 chars copied + NUL = 3 bytes */
+  buffer[0] = '\0';
+  strncat(buffer, "AB", 100);
+  puts(buffer);
+
+  /* Safe: partially filled, append fits exactly.
+   * buffer = "ABCD" (4 chars), append "EFG" with n=3 → 4+3+1 = 8 = exact fit */
+  buffer[0] = '\0';
+  strncat(buffer, "ABCD", 4);
+  strncat(buffer, "EFG", 3);
+  puts(buffer);
+
+  /* Safe: n limits copy to fit.
+   * buffer = "ABCDE" (5 chars), src = "FGHIJKLM" (8 chars), n=2 → 5+2+1 = 8 */
+  buffer[0] = '\0';
+  strncat(buffer, "ABCDE", 5);
+  strncat(buffer, "FGHIJKLM", 2);
+  puts(buffer);
+
+  /* All safe operations passed without trapping */
+  return 0;
+}
diff --git a/tests/test_strncat_static_write.c b/tests/test_strncat_static_write.c
index 7fe89ff..53d1532 100644
--- a/tests/test_strncat_static_write.c
+++ b/tests/test_strncat_static_write.c
@@ -4,15 +4,15 @@
 
 int main(int argc, char** argv) {
   char buffer[8] = {0};
-  char src[] = {'1', '2', '3', '4', '5', '6', '7', '8', '9', '0'};
-  strncat(buffer, src, 5);
+  strncat(buffer, "12345", 5);
   puts(buffer);
 
-#if 0
+  /* n=4 is less than buffer size (8), but buffer already has 5 chars,
+   * so appending 4 more + NUL = 10 bytes total, overflowing the buffer.
+   */
   CHK_FAIL_START
-  strncat(buffer, src, 10);
+  strncat(buffer, "ABCD", 4);
   CHK_FAIL_END
-#endif
 
   puts(buffer);
   return ret;
diff --git a/tests/test_swab_negative.c b/tests/test_swab_negative.c
new file mode 100644
index 0000000..f9c182b
--- /dev/null
+++ b/tests/test_swab_negative.c
@@ -0,0 +1,19 @@
+#include "common.h"
+
+#include <unistd.h>
+
+int main(int argc, char** argv) {
+  char src[8] = "ABCDEFG";
+  char dst[8] = {0};
+
+  /* Positive case: normal swab works */
+  swab(src, dst, 6);
+  puts(dst);
+
+  /* Negative n: POSIX says swab does nothing, must NOT trap */
+  swab(src, dst, -1);
+  swab(src, dst, -100);
+
+  puts(dst);
+  return ret;
+}
diff --git a/tests/test_wcrtomb.c b/tests/test_wcrtomb.c
new file mode 100644
index 0000000..e4bc885
--- /dev/null
+++ b/tests/test_wcrtomb.c
@@ -0,0 +1,9 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main() {
+        char c;
+        wcrtomb(&c, L'0', NULL);
+        return 0;
+}
diff --git a/tests/test_wcscat_dynamic_write.c b/tests/test_wcscat_dynamic_write.c
new file mode 100644
index 0000000..064f018
--- /dev/null
+++ b/tests/test_wcscat_dynamic_write.c
@@ -0,0 +1,21 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wchar_t src[20];
+  int i;
+  wcscat(buffer, L"α");
+
+  for (i = 0; i < argc; i++)
+    src[i] = L'A';
+  src[i] = L'\0';
+
+  CHK_FAIL_START
+  wcscat(buffer, src);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcscpy_dynamic_write.c b/tests/test_wcscpy_dynamic_write.c
new file mode 100644
index 0000000..5055e9c
--- /dev/null
+++ b/tests/test_wcscpy_dynamic_write.c
@@ -0,0 +1,22 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wchar_t src[20];
+  int i;
+  wcscpy(buffer, L"α");
+  printf("%ls\n", buffer);
+
+  for (i = 0; i < argc; i++)
+    src[i] = L'A';
+  src[i] = L'\0';
+
+  CHK_FAIL_START
+  wcscpy(buffer, src);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsncat_dynamic_write.c b/tests/test_wcsncat_dynamic_write.c
new file mode 100644
index 0000000..9f87172
--- /dev/null
+++ b/tests/test_wcsncat_dynamic_write.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wcsncat(buffer, L"αβγδεζηθικλμνξοπρστυφχψω", 2);
+  printf("%ls\n", buffer);
+
+  CHK_FAIL_START
+  wcsncat(buffer, L"αβγδεζηθικλμνξοπρστυφχψω", argc + 1336);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsncat_n_eq_buf.c b/tests/test_wcsncat_n_eq_buf.c
new file mode 100644
index 0000000..e516842
--- /dev/null
+++ b/tests/test_wcsncat_n_eq_buf.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wcsncat(buffer, L"12345", 5);
+  printf("%ls\n", buffer);
+
+  /* n == buffer capacity but overflow due to existing content.
+   * buffer has 5 wchars, src L"ABC" (len 3): 5+3+1 = 9 > 8 → overflow. */
+  CHK_FAIL_START
+  wcsncat(buffer, L"ABC", 8);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsncat_n_gt_buf.c b/tests/test_wcsncat_n_gt_buf.c
new file mode 100644
index 0000000..186b8c0
--- /dev/null
+++ b/tests/test_wcsncat_n_gt_buf.c
@@ -0,0 +1,17 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wcsncat(buffer, L"12345", 5);
+  printf("%ls\n", buffer);
+
+  /* n > buffer capacity and overflow: n=10, buffer has 5 wchars. */
+  CHK_FAIL_START
+  wcsncat(buffer, L"1234567890", 10);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsncat_n_lt_buf.c b/tests/test_wcsncat_n_lt_buf.c
new file mode 100644
index 0000000..99a42de
--- /dev/null
+++ b/tests/test_wcsncat_n_lt_buf.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wcsncat(buffer, L"12345", 5);
+  printf("%ls\n", buffer);
+
+  /* n < buffer capacity but overflow due to existing content.
+   * buffer has 5 wchars, src L"ABCD" (len 4), min(4,3)=3: 5+3+1 = 9 > 8. */
+  CHK_FAIL_START
+  wcsncat(buffer, L"ABCD", 3);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsncat_n_one.c b/tests/test_wcsncat_n_one.c
new file mode 100644
index 0000000..23de28e
--- /dev/null
+++ b/tests/test_wcsncat_n_one.c
@@ -0,0 +1,18 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wcsncat(buffer, L"1234567", 7);
+  printf("%ls\n", buffer);
+
+  /* n=1, buffer has 7 wchars.
+   * 7+1+1 = 9 > 8 → overflow. Even n=1 can overflow a nearly-full buffer. */
+  CHK_FAIL_START
+  wcsncat(buffer, L"X", 1);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsncat_safe.c b/tests/test_wcsncat_safe.c
new file mode 100644
index 0000000..00fc8e6
--- /dev/null
+++ b/tests/test_wcsncat_safe.c
@@ -0,0 +1,34 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+
+  /* Safe: empty buffer, append 7 wide chars → exactly fills buffer */
+  wcsncat(buffer, L"ABCDEFG", 7);
+  printf("%ls\n", buffer);
+
+  /* Safe: reset, append with n larger than source.
+   * src is L"AB" (len 2), n=100 → only 2 wchars copied */
+  buffer[0] = L'\0';
+  wcsncat(buffer, L"AB", 100);
+  printf("%ls\n", buffer);
+
+  /* Safe: partially filled, append fits exactly.
+   * buffer = L"ABCD" (4 wchars), append L"EFG" n=3 → 4+3+1 = 8 = exact fit */
+  buffer[0] = L'\0';
+  wcsncat(buffer, L"ABCD", 4);
+  wcsncat(buffer, L"EFG", 3);
+  printf("%ls\n", buffer);
+
+  /* Safe: n limits copy to fit.
+   * buffer = L"ABCDE" (5 wchars), src long, n=2 → 5+2+1 = 8 = exact fit */
+  buffer[0] = L'\0';
+  wcsncat(buffer, L"ABCDE", 5);
+  wcsncat(buffer, L"FGHIJKLM", 2);
+  printf("%ls\n", buffer);
+
+  /* All safe operations passed without trapping */
+  return 0;
+}
diff --git a/tests/test_wcsncpy_dynamic_write.c b/tests/test_wcsncpy_dynamic_write.c
new file mode 100644
index 0000000..3078c0e
--- /dev/null
+++ b/tests/test_wcsncpy_dynamic_write.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wcsncpy(buffer, L"αβγδεζηθικλμνξοπρστυφχψω", 1);
+  printf("%ls\n", buffer);
+
+  CHK_FAIL_START
+  wcsncpy(buffer, L"αβγδεζηθικλμνξοπρστυφχψω", argc + 1336);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wcsnrtombs_dynamic.c b/tests/test_wcsnrtombs_dynamic.c
new file mode 100644
index 0000000..1637e71
--- /dev/null
+++ b/tests/test_wcsnrtombs_dynamic.c
@@ -0,0 +1,26 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[8] = {0};
+  const wchar_t src[] = L"ABCD";
+  const wchar_t *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  /* Safe: convert up to 4 wide chars, write at most 4 bytes */
+  srcp = src;
+  wcsnrtombs(buffer, &srcp, 4, 4, &st);
+
+  /* Unsafe: ask to write argc (10) bytes into 8-byte buffer. */
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  wcsnrtombs(buffer, &srcp, 4, argc, &st);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_wcsnrtombs_static.c b/tests/test_wcsnrtombs_static.c
new file mode 100644
index 0000000..da529f1
--- /dev/null
+++ b/tests/test_wcsnrtombs_static.c
@@ -0,0 +1,26 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[4] = {0};
+  const wchar_t src[] = L"ABCDEFGHIJ";
+  const wchar_t *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  /* Safe: convert up to 2 wide chars, write at most 2 bytes */
+  srcp = src;
+  wcsnrtombs(buffer, &srcp, 2, 2, &st);
+
+  /* Unsafe: ask to write 16 bytes into 4-byte buffer */
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  wcsnrtombs(buffer, &srcp, 10, 16, &st);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_wcsrtombs_dynamic.c b/tests/test_wcsrtombs_dynamic.c
new file mode 100644
index 0000000..674a75f
--- /dev/null
+++ b/tests/test_wcsrtombs_dynamic.c
@@ -0,0 +1,24 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[4] = {0};
+  const wchar_t src[] = L"ABCDEFGHIJ";
+  const wchar_t *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  srcp = src;
+  wcsrtombs(buffer, &srcp, 2, &st);
+
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  wcsrtombs(buffer, &srcp, argc + 15, &st);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_wcsrtombs_static.c b/tests/test_wcsrtombs_static.c
new file mode 100644
index 0000000..ffb4919
--- /dev/null
+++ b/tests/test_wcsrtombs_static.c
@@ -0,0 +1,24 @@
+#include "common.h"
+
+#include <wchar.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+  char buffer[4] = {0};
+  const wchar_t src[] = L"ABCDEFGHIJ";
+  const wchar_t *srcp = src;
+  mbstate_t st;
+  memset(&st, 0, sizeof(st));
+
+  srcp = src;
+  wcsrtombs(buffer, &srcp, 2, &st);
+
+  srcp = src;
+  memset(&st, 0, sizeof(st));
+  CHK_FAIL_START
+  wcsrtombs(buffer, &srcp, 16, &st);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_wcstombs_dynamic.c b/tests/test_wcstombs_dynamic.c
new file mode 100644
index 0000000..6f3962d
--- /dev/null
+++ b/tests/test_wcstombs_dynamic.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  char buffer[4] = {0};
+
+  wcstombs(buffer, L"AB", 2);
+
+  CHK_FAIL_START
+  wcstombs(buffer, L"ABCDEFGHIJ", argc + 15);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_wcstombs_static.c b/tests/test_wcstombs_static.c
new file mode 100644
index 0000000..5939793
--- /dev/null
+++ b/tests/test_wcstombs_static.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  char buffer[4] = {0};
+
+  wcstombs(buffer, L"AB", 2);
+
+  CHK_FAIL_START
+  wcstombs(buffer, L"ABCDEFGHIJ", 16);
+  CHK_FAIL_END
+
+  puts(buffer);
+  return ret;
+}
diff --git a/tests/test_wmemcpy_dynamic_read.c b/tests/test_wmemcpy_dynamic_read.c
new file mode 100644
index 0000000..20ba0ad
--- /dev/null
+++ b/tests/test_wmemcpy_dynamic_read.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[12] = {0};
+  wmemcpy(buffer, L"αβγδεζηθικ", sizeof(buffer) / sizeof(wchar_t) - 1);
+  printf("%ls\n", buffer);
+
+  CHK_FAIL_START
+  wmemcpy(buffer, L"αβγδεζ", argc);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wmemcpy_static_read.c b/tests/test_wmemcpy_static_read.c
new file mode 100644
index 0000000..c87d378
--- /dev/null
+++ b/tests/test_wmemcpy_static_read.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wmemcpy(buffer, L"αβγδεζ", 4);
+  printf("%ls\n", buffer);
+
+  CHK_FAIL_START
+  wmemcpy(buffer, L"αβγδεζ", sizeof(buffer) / sizeof(wchar_t));
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wmemmove_dynamic_read.c b/tests/test_wmemmove_dynamic_read.c
new file mode 100644
index 0000000..05e315b
--- /dev/null
+++ b/tests/test_wmemmove_dynamic_read.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[12] = {0};
+  wmemmove(buffer, L"αβγδεζηθικ", sizeof(buffer) / sizeof(wchar_t) - 1);
+  printf("%ls\n", buffer);
+
+  CHK_FAIL_START
+  wmemmove(buffer, L"αβγδεζ", argc);
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}
diff --git a/tests/test_wmemmove_static_read.c b/tests/test_wmemmove_static_read.c
new file mode 100644
index 0000000..6e4a929
--- /dev/null
+++ b/tests/test_wmemmove_static_read.c
@@ -0,0 +1,16 @@
+#include "common.h"
+
+#include <wchar.h>
+
+int main(int argc, char** argv) {
+  wchar_t buffer[8] = {0};
+  wmemmove(buffer, L"αβγδεζ", 4);
+  printf("%ls\n", buffer);
+
+  CHK_FAIL_START
+  wmemmove(buffer, L"αβγδεζ", sizeof(buffer) / sizeof(wchar_t));
+  CHK_FAIL_END
+
+  printf("%ls\n", buffer);
+  return ret;
+}