In fuzzing applications with Pin (the Pintool source code is hosted here, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace:
... 0x404f94 test edx, edx 0x404f96 jnz 0x404fe1 0x404fe1 pop ebp 0x404f89 rep cmpsb byte ptr [esi], byte ptr [edi] 0x404f8b pop edi 0x404f8c pop esi 0x404f8d jz 0x404f94 0x404f8f sbb edx, edx ...
is extracted from the execution of wget. The bizarre observation is that the instruction after 0x404f8f is somehow arbitrary, normaly it should be:
0x404f91 sbb edx, 0xffffffff
but "sometimes" it is:
0x779a015d add esp, 0x4
which is located in the NtWaitForMultipleObjects. To say "sometimes", I mean that it does not always happen but it happens and that is 100% reproducible.
I still cannot figure out what happened here. First, the observation means that the control-flow of the program has been changed in a unpredictable way. Second, the bizarre instruction located in NtWaitForMultipleObjects, namely it must be in the kernel-space, but here I have observed it in the program (i.e. in the user-space).
I know that this question is quite specific but feel free to request me more information. I really appreciate any help.