@@ -72,17 +72,26 @@ jobs:
             debug: debug
             coverage: nocoverage
             shell: bash
-          # This test gives false positives on newer versions of clang
-          # and ubuntu-18.04 is not supported anymore on github
-          #- test-group: extra
-          #  os: ubuntu-18.04
-          #  os-type: ubuntu
-          #  build-type: msan
-          #  compiler-family: clang
-          #  c-compiler: clang-6.0
-          #  cc-compiler: clang++-6.0
-          #  debug: debug
-          #  coverage: nocoverage
+          # TASK-087: restored msan lane. The previous entry (retired
+          # Ubuntu / Clang toolchain) was dropped when GitHub removed that
+          # runner image and never replaced, so MemorySanitizer went
+          # silently absent. This lane runs clang-18 against an
+          # instrumented libc++ + instrumented
+          # libmicrohttpd (both built and cached in-CI), with gnutls and
+          # curl kept out of the picture. See the "instrumented libc++"
+          # and "Run tests" steps below for how the false-positive-free
+          # dependency set is assembled and why coverage is scoped to the
+          # backend-free unit tests.
+          - test-group: extra
+            os: ubuntu-latest
+            os-type: ubuntu
+            build-type: msan
+            compiler-family: clang
+            c-compiler: clang-18
+            cc-compiler: clang++-18
+            debug: debug
+            coverage: nocoverage
+            shell: bash
           - test-group: extra
             os: ubuntu-latest
             os-type: ubuntu
@@ -586,7 +595,10 @@ jobs:
       # TASK-076: also skip on the tls-no-cli lane — it does its own
       # install of libgnutls28-dev WITHOUT gnutls-bin in the next step
       # so the per-test LT_SKIP_IF(!has_gnutls_cli(), ...) gate fires.
-      if: ${{ matrix.os-type == 'ubuntu' && matrix.build-type != 'flag-invariance-off' && matrix.build-type != 'tls-no-cli' }}
+      # TASK-087: also skip on the msan lane — installing gnutls would pull
+      # an uninstrumented gnutls/nettle/gmp tree into LDADD; with no header
+      # present configure auto-detects HAVE_GNUTLS=no and -lgnutls drops out.
+      if: ${{ matrix.os-type == 'ubuntu' && matrix.build-type != 'flag-invariance-off' && matrix.build-type != 'tls-no-cli' && matrix.build-type != 'msan' }}
 
     - name: Setup gnutls dependency WITHOUT gnutls-cli (TASK-076 tls-no-cli lane)
       run: |
@@ -601,6 +613,34 @@ jobs:
         fi
       if: ${{ matrix.build-type == 'tls-no-cli' }}
 
+    # TASK-087: MemorySanitizer reports use-of-uninitialized-value for any
+    # bytes written by uninstrumented code and later read by instrumented
+    # code. libc++ is on nearly every code path, so it must be instrumented
+    # too. Build LLVM libc++/libc++abi with MemoryWithOrigins once and cache
+    # the install prefix (keyed by os + compiler); rebuild only on a miss.
+    - name: Fetch instrumented libc++ from cache (msan lane)
+      id: cache-libcxx-msan
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+      with:
+        path: ${{ github.workspace }}/libcxx-msan
+        key: ${{ matrix.os }}-${{ matrix.c-compiler }}-libcxx-msan-origins-v1
+      if: ${{ matrix.build-type == 'msan' }}
+
+    - name: Build instrumented libc++ (msan lane, if not cached)
+      run: |
+        sudo apt-get install -y ninja-build cmake ;
+        git clone --depth 1 --branch llvmorg-18.1.8 https://github.com/llvm/llvm-project.git llvm-project ;
+        cmake -G Ninja -S llvm-project/runtimes -B build-libcxx-msan \
+          -DCMAKE_C_COMPILER=clang-18 \
+          -DCMAKE_CXX_COMPILER=clang++-18 \
+          -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
+          -DLLVM_USE_SANITIZER=MemoryWithOrigins \
+          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/libcxx-msan" ;
+        ninja -C build-libcxx-msan cxx cxxabi ;
+        ninja -C build-libcxx-msan install-cxx install-cxxabi ;
+      if: ${{ matrix.build-type == 'msan' && steps.cache-libcxx-msan.outputs.cache-hit != 'true' }}
+
     - name: Fetch libmicrohttpd from cache
       id: cache-libmicrohttpd
       uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
@@ -612,7 +652,10 @@ jobs:
       # The flag-invariance-on lane uses the stock build because
       # libmicrohttpd 1.0.3 ships TLS/Basic/Digest auth on by default and
       # does NOT ship the websocket extension at all.
-      if: ${{ matrix.os-type != 'windows' && matrix.build-type != 'no-dauth' && matrix.build-type != 'flag-invariance-off' && matrix.compiler-family != 'arm-cross' }}
+      # TASK-087: the msan lane rebuilds libmicrohttpd instrumented (so MHD
+      # output is not read back as uninitialized), so it skips this stock
+      # cache/build too.
+      if: ${{ matrix.os-type != 'windows' && matrix.build-type != 'no-dauth' && matrix.build-type != 'flag-invariance-off' && matrix.build-type != 'msan' && matrix.compiler-family != 'arm-cross' }}
 
     - name: Build libmicrohttpd dependency (if not cached)
       run: |
@@ -625,7 +668,8 @@ jobs:
       # TASK-037: as above -- flag-invariance-off has its own dedicated
       # libmicrohttpd build step below; flag-invariance-on uses the stock
       # build because libmicrohttpd 1.0.3 ships no websocket extension.
-      if: ${{ matrix.os-type != 'windows' && matrix.build-type != 'no-dauth' && matrix.build-type != 'flag-invariance-off' && matrix.compiler-family != 'arm-cross' && steps.cache-libmicrohttpd.outputs.cache-hit != 'true' }}
+      # TASK-087: msan has its own dedicated instrumented build step below.
+      if: ${{ matrix.os-type != 'windows' && matrix.build-type != 'no-dauth' && matrix.build-type != 'flag-invariance-off' && matrix.build-type != 'msan' && matrix.compiler-family != 'arm-cross' && steps.cache-libmicrohttpd.outputs.cache-hit != 'true' }}
 
 
     - name: Build libmicrohttpd without digest auth (no-dauth test)
@@ -656,6 +700,30 @@ jobs:
         make ;
       if: ${{ matrix.build-type == 'flag-invariance-off' && steps.cache-libmicrohttpd-off.outputs.cache-hit != 'true' }}
 
+    - name: Fetch libmicrohttpd from cache (msan lane)
+      id: cache-libmicrohttpd-msan
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+      with:
+        path: libmicrohttpd-1.0.3
+        key: ${{ matrix.os }}-${{ matrix.c-compiler }}-libmicrohttpd-1.0.3-msan-v1
+      if: ${{ matrix.build-type == 'msan' }}
+
+    - name: Build instrumented libmicrohttpd (TASK-087 msan lane)
+      run: |
+        curl https://s3.amazonaws.com/libhttpserver/libmicrohttpd_releases/libmicrohttpd-1.0.3.tar.gz -o libmicrohttpd-1.0.3.tar.gz ;
+        echo "7816b57aae199cf5c3645e8770e1be5f0a4dfafbcb24b3772173dc4ee634126a  libmicrohttpd-1.0.3.tar.gz" | sha256sum -c ;
+        tar -xzf libmicrohttpd-1.0.3.tar.gz ;
+        cd libmicrohttpd-1.0.3 ;
+        # Instrument MHD with MemorySanitizer so its output buffers, which
+        # libhttpserver reads on nearly every code path, are not flagged as
+        # uninitialized. --disable-https keeps gnutls (uninstrumented) out.
+        export CC=clang-18 ;
+        export CFLAGS='-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer -g -O1' ;
+        export LDFLAGS='-fsanitize=memory' ;
+        ./configure --disable-examples --disable-https ;
+        make ;
+      if: ${{ matrix.build-type == 'msan' && steps.cache-libmicrohttpd-msan.outputs.cache-hit != 'true' }}
+
     - name: Install libmicrohttpd
       run: cd libmicrohttpd-1.0.3 ; sudo make install ;
       if: ${{ matrix.os-type != 'windows' && matrix.compiler-family != 'arm-cross' }}
@@ -785,7 +853,16 @@ jobs:
       run: |
         # Set memory check flags. They need to stay in step as env variables don't propagate across steps.
         if [ "$BUILD_TYPE" = "asan" ]; then export CFLAGS='-fsanitize=address'; export CXXFLAGS='-fsanitize=address'; export LDFLAGS='-fsanitize=address'; fi
-        if [ "$BUILD_TYPE" = "msan" ]; then export CFLAGS='-fsanitize=memory'; export CXXFLAGS='-fsanitize=memory'; export LDFLAGS='-fsanitize=memory'; fi
+        # TASK-087: msan needs the instrumented libc++ built above, plus
+        # origins tracking and frame pointers for readable reports. Point
+        # the C++ TUs at the instrumented libc++ headers/libs and drop the
+        # default (uninstrumented) libstdc++ via -nostdinc++/-stdlib=libc++.
+        if [ "$BUILD_TYPE" = "msan" ]; then
+          LIBCXX_MSAN="${{ github.workspace }}/libcxx-msan" ;
+          export CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer -g -O1" ;
+          export CXXFLAGS="-stdlib=libc++ -nostdinc++ -isystem ${LIBCXX_MSAN}/include/c++/v1 -fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer -g -O1" ;
+          export LDFLAGS="-stdlib=libc++ -fsanitize=memory -L${LIBCXX_MSAN}/lib -Wl,-rpath,${LIBCXX_MSAN}/lib -lc++abi" ;
+        fi
         if [ "$BUILD_TYPE" = "lsan" ]; then export CFLAGS='-fsanitize=leak'; export CXXFLAGS='-fsanitize=leak'; export LDFLAGS='-fsanitize=leak'; fi
         if [ "$BUILD_TYPE" = "tsan" ]; then export CFLAGS='-fsanitize=thread'; export CXXFLAGS='-fsanitize=thread'; export LDFLAGS='-fsanitize=thread'; fi
         if [ "$BUILD_TYPE" = "ubsan" ]; then export CFLAGS='-fsanitize=undefined'; export CXXFLAGS='-fsanitize=undefined'; export LDFLAGS='-fsanitize=undefined'; fi
@@ -949,8 +1026,32 @@ jobs:
         # (see test/tsan.supp). All libhttpserver-internal races stay fatal.
         if [ "$BUILD_TYPE" = "tsan" ]; then
           export TSAN_OPTIONS="suppressions=$(pwd)/../test/tsan.supp" ;
+          make check ;
+        elif [ "$BUILD_TYPE" = "msan" ]; then
+          # TASK-087: msan coverage is deliberately scoped to the
+          # backend-free UNIT tests. curl (linked into every integ
+          # round-trip via test/integ/curl_helpers.hpp) cannot be
+          # practically instrumented, so its uninstrumented output would
+          # surface as false use-of-uninitialized-value reports. libc++ and
+          # libmicrohttpd ARE instrumented (see the steps above), so the
+          # unit subset — pure libhttpserver logic plus instrumented-MHD
+          # type inspection — runs clean without wildcard suppressions.
+          export LD_LIBRARY_PATH="${{ github.workspace }}/libcxx-msan/lib:${LD_LIBRARY_PATH:-}" ;
+          export MSAN_OPTIONS="abort_on_error=1" ;
+          # Auto-wire narrow suppressions only if triage produced the file.
+          # test/msan.supp is intentionally ABSENT until a real finding
+          # forces a narrow use-of-uninitialized-value:<symbol> entry with
+          # an upstream-issue comment (never a wildcard over libhttpserver).
+          if [ -f ../test/msan.supp ]; then
+            export MSAN_OPTIONS="${MSAN_OPTIONS}:suppressions=$(pwd)/../test/msan.supp" ;
+          fi
+          # Derive the unit/ subset from the test Makefile so newly-added
+          # unit tests are covered automatically.
+          MSAN_TESTS="$(grep -oE '^[A-Za-z0-9_]+_SOURCES[[:space:]]*=[[:space:]]*unit/' ../test/Makefile.am | sed -E 's/_SOURCES.*//' | tr '\n' ' ')" ;
+          make check TESTS="$MSAN_TESTS" ;
+        else
+          make check ;
         fi
-        make check;
       # TASK-037: flag-invariance-{on,off} are compile/link-only gates, so
       # skip the full `make check` (which spins up real servers and would
       # crash on the OFF lane for the BAUTH/DAUTH/WS unit tests anyway).
 
@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+#
+# check-msan-lane.sh — structural gate for TASK-087 ("Restore msan CI lane").
+#
+# The v2-branch-gap audit flagged that the MemorySanitizer (msan) CI lane
+# went silently absent: its matrix entry in
+# `.github/workflows/verify-build.yml` was commented out when Ubuntu 18.04 /
+# clang-6.0 were retired, and asan/lsan/tsan/ubsan carried on without it.
+# TASK-087 restores a current, instrumented-libc++ msan lane.
+#
+# A full GitHub Actions msan build cannot run on a developer's machine (it
+# needs an instrumented libc++ and libmicrohttpd built in-CI), so acceptance
+# is split: this LOCAL structural gate asserts the workflow is wired
+# correctly, and the REAL green run happens on the PR. This mirrors the
+# repo idiom of a self-testing `scripts/check-*.sh` gate paired with a
+# `scripts/test_check_*.sh` unit test (see check-warning-suppressions.sh).
+#
+# Assertions against `.github/workflows/verify-build.yml`:
+#   (a) the file parses as valid YAML (via python3 + PyYAML; NOT actionlint
+#       or yamllint, which are not guaranteed present on the runner);
+#   (b) a matrix `include:` entry with `build-type: msan` exists and carries
+#       the keys mirrored from the asan entry (test-group/os/os-type/
+#       compiler-family/c-compiler/cc-compiler/debug/coverage/shell);
+#   (c) the stale `ubuntu-18.04` / `clang-6.0` commented msan block is GONE;
+#   (d) the "Run tests" step wires `MSAN_OPTIONS` and a scoped `TESTS=`
+#       invocation (msan coverage is deliberately scoped to backend-free
+#       unit tests because curl is uninstrumented).
+#
+# Exit codes:
+#   0  workflow is wired correctly
+#   1  one or more assertions failed
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+WF="${1:-.github/workflows/verify-build.yml}"
+
+echo "check-msan-lane: inspecting $WF"
+
+if [ ! -f "$WF" ]; then
+    echo "check-msan-lane: FAIL — workflow file not found: $WF" >&2
+    exit 1
+fi
+
+fail=0
+
+# (a) valid YAML  +  (b) msan include entry with mirrored keys.
+# Both are structural, so PyYAML parses the file and inspects the matrix.
+if ! python3 - "$WF" <<'PY'
+import sys
+try:
+    import yaml
+except ImportError:
+    print("  PyYAML not importable — install with 'pip install pyyaml'", file=sys.stderr)
+    sys.exit(10)
+
+path = sys.argv[1]
+try:
+    doc = yaml.safe_load(open(path))
+except Exception as e:  # noqa: BLE001 - surface any parse failure
+    print(f"  (a) YAML parse error: {e}", file=sys.stderr)
+    sys.exit(2)
+
+# Locate the matrix include list in whichever job defines it (job name is
+# not hard-coded so the gate survives a rename).
+include = None
+for job_name, job in (doc.get("jobs") or {}).items():
+    if not isinstance(job, dict):
+        continue
+    inc = (((job.get("strategy") or {}).get("matrix") or {}).get("include"))
+    if isinstance(inc, list):
+        include = inc
+        break
+if include is None:
+    print("  (b) could not locate strategy.matrix.include in any job", file=sys.stderr)
+    sys.exit(3)
+
+msan = [e for e in include if isinstance(e, dict) and e.get("build-type") == "msan"]
+if not msan:
+    print("  (b) no matrix include entry with build-type: msan", file=sys.stderr)
+    sys.exit(4)
+if len(msan) > 1:
+    print(f"  (b) expected exactly one msan include entry, found {len(msan)}", file=sys.stderr)
+    sys.exit(5)
+entry = msan[0]
+
+# Keys mirrored from the asan entry: fixed-value keys must match, and the
+# per-lane keys must simply be present (value-agnostic so a future os/compiler
+# bump does not break the gate).
+fixed = {
+    "test-group": "extra",
+    "compiler-family": "clang",
+    "debug": "debug",
+    "coverage": "nocoverage",
+    "shell": "bash",
+}
+present = ("os", "os-type", "c-compiler", "cc-compiler")
+problems = []
+for k, v in fixed.items():
+    if entry.get(k) != v:
+        problems.append(f"{k}={entry.get(k)!r} (want {v!r})")
+for k in present:
+    if not entry.get(k):
+        problems.append(f"{k} missing")
+if problems:
+    print("  (b) msan include entry missing/incorrect keys: " + ", ".join(problems), file=sys.stderr)
+    sys.exit(6)
+
+print(f"  (a) YAML parses; (b) msan include entry present with mirrored keys "
+      f"(os={entry['os']}, c-compiler={entry['c-compiler']})")
+PY
+then
+    echo "  (a)/(b) FAILED" >&2
+    fail=1
+fi
+
+# (c) The stale ubuntu-18.04 / clang-6.0 commented msan block must be gone.
+# Look for a commented-out matrix entry that pairs a msan build-type with the
+# retired ubuntu-18.04 / clang-6.0 toolchain.
+if grep -qE '^[[:space:]]*#.*ubuntu-18\.04' "$WF" || grep -qE '^[[:space:]]*#.*clang-6\.0' "$WF"; then
+    echo "  (c) stale commented msan block (ubuntu-18.04 / clang-6.0) is still present" >&2
+    fail=1
+else
+    echo "  (c) stale ubuntu-18.04 / clang-6.0 commented msan block removed"
+fi
+
+# (d) The "Run tests" step must wire MSAN_OPTIONS and a scoped TESTS= run.
+if grep -q 'MSAN_OPTIONS' "$WF"; then
+    echo "  (d1) MSAN_OPTIONS wiring present"
+else
+    echo "  (d1) MSAN_OPTIONS wiring absent from the workflow" >&2
+    fail=1
+fi
+if grep -qE 'make check TESTS=' "$WF"; then
+    echo "  (d2) scoped 'make check TESTS=' invocation present"
+else
+    echo "  (d2) scoped 'make check TESTS=' invocation absent from the workflow" >&2
+    fail=1
+fi
+
+if [ "$fail" -ne 0 ]; then
+    echo "check-msan-lane: FAIL — the msan lane is not fully wired" >&2
+    exit 1
+fi
+
+echo "check-msan-lane: PASS — msan lane structurally wired"