From a91bc9cd0fbb384ec135d5429ad5dcae56449042 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Thu, 8 Oct 2026 00:32:43 +0200
Subject: [PATCH] crypto.ml_kem: work around LLVM23 miscompilation on riscv64

Coefficient extraction generates bogus code with u64 batches.
Using u32 batches seems to work around it.
---
 lib/std/crypto/ml_kem.zig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/std/crypto/ml_kem.zig b/lib/std/crypto/ml_kem.zig
index 65d4c81ec9744f75123b89f31e6e00ae357c6845..4385da81b475860687358b01539fdf1302cae92a 100644
--- a/lib/std/crypto/ml_kem.zig
+++ b/lib/std/crypto/ml_kem.zig
@@ -1179,6 +1179,7 @@ const Poly = struct {
 
         const T = switch (builtin.target.cpu.arch) {
             .x86_64, .x86 => u32, // Generates better code on Intel CPUs
+            .riscv64 => u32, // Work around LLVM miscompiling coefficient extraction with u64 batches https://codeberg.org/ziglang/zig/issues/37128
             else => u64, // u128 might be faster on some other CPUs.
         };
 
-- 
2.54.0