Source-level findings in FSL (Oxford WIN,
git.fmrib.ox.ac.uk/fsl/*), found while auditing the components most used by 114
papers in Nature, Science, PNAS and Cell (2021–2026). Each finding ships as a
ready-to-file report with file:line evidence, a runnable verification harness where
one exists, and a git format-patch fix where the change is crisp.
FSL's sanctioned external bug channel is the
FSL JISCMail mailing list
(the GitLab instance does not accept outside signups), so the reports here are
written as ready-to-send list posts. emails/00-intro-post.md is the opening
thread; each findings/*/report.md is its own follow-up thread.
| # | Component | One line | Verified by | Patch | Filed |
|---|---|---|---|---|---|
| 01 | miscmaths f2z.cc |
Misplaced parenthesis understates zfstat for ≥3-row F-contrasts (all versions, non-monotone, +inf fallthrough) | compiled verbatim vs 400-digit mpmath; independently derived twice | ✔ | ☐ |
| 02 | flameo gsmanager.cc |
FLAME1+2 F-test dof collapses to ≈3 for ≥2-EV designs (univariate moment matching on a P-dim fit) | faithful port vs known-dof samples | ✔ | ☐ |
| 03 | film AutoCorrEstimator.cc |
Tukey taper off by one lag (lag 0 tapered) → every default first-level t/z inflated ~1–1.5% | 9,000-rep pipeline simulation | ✔ | ☐ |
| 04 | cluster/smoothest/infer | 2D images get 3D GRF constants (100–12,000× anticonservative); dof-LUT interpolation off by a node; (2π) sign at t≥8 | compiled verbatim + line-faithful transcription | ✔ (LUT) | ☐ |
| 05 | flirt flirt.cc |
-usesqform init scaled by basescale twice; auto-enables <0.75 mm → 7T/HCP starts tens of mm off |
matrix algebra traced | ✔ | ☐ |
| 06 | topup applytopup.cpp |
jac fieldmap branch scales y-displacement by xdim (anisotropic in-plane voxels) | code inspection vs spline branch | ✔ | ☐ |
| 07 | randomise/newimage | Fast TFCE excludes the outermost voxel shell (border voxels untestable); pre-5.0.7 F-TFCE statistic change; --uncorrp cluster images all zero |
code inspection + history | design choice | ☐ |
| 08 | newimage/warpfns | Sinc interpolation races on shared kernel buffers with FSL_NUM_THREADS>1 — wrong, nondeterministic voxels |
code inspection (const method writes shared state) | design choice | ☐ |
| 09 | flirt costfns.cc |
BBR fieldmap extrapolation transforms a homogeneous point, not a direction; PE axis hard-coded to y | code inspection | design choice | ☐ |
| 10 | fdt dtifit | 1%-of-S0 floor caps ADC at 4.6/b (CSF MD ~2× low at b=3000); negative eigenvalues reach outputs (FA>1) | code inspection + arithmetic | policy choice | ☐ |
| 11 | bet2/fast4 | BET2 volumes ~1–2% high (one-sided voxelization + heteroscedastic fallback); FAST4 smoothing ≠ docs | code inspection vs Smith 2002 / docs | policy choice | ☐ |
Tick the Filed box (and add the list-archive link) as each post goes out.
findings/NN-name/
report.md ready-to-send JISCMail post (subject line at top)
fix/ git format-patch against current master of the component repo
verify/ runnable harness reproducing the numbers in the report
verified-correct/ harnesses for suspect code that turned out to be RIGHT
emails/00-intro-post.md the opening thread for the list
Python harnesses need only numpy/scipy (mpmath for the 400-digit checks):
python3 findings/01-f2z-ftest-tail/verify/check_f2z.py
python3 findings/02-flame12-fdof/verify/test_flame.py
python3 findings/03-film-tukey-taper/verify/film_sim.py # ~minutes (9,000 reps)
python3 findings/04-grf-cluster-correction/verify/infer_check.pyC++ harnesses compile the FSL routine under test verbatim, no FSL install needed:
g++ -O2 -o f2zcheck findings/01-f2z-ftest-tail/verify/f2zcheck.cc && ./f2zcheck
g++ -O2 -o lut_test findings/04-grf-cluster-correction/verify/lut_test.cc && ./lut_testEach patch applies to the current master of its component repo:
git clone https://git.fmrib.ox.ac.uk/fsl/miscmaths.git && cd miscmaths
git am ../findings/01-f2z-ftest-tail/fix/0001-*.patch(Components: 01 → fsl/miscmaths, 02 → fsl/flameo, 03 → fsl/film,
04 → fsl/cluster, 05 → fsl/flirt, 06 → fsl/topup.)
The same audit cleared the code most results actually rest on: t→z conversion (exact
to ~1e-4 z, dof 3–1000), the 3D GRF formulas (exact Friston/Worsley), randomise's
permutation core (exact Phipson–Smyth p-values, genuine Freedman–Lane), FLAME's
t-contrast paths (OLS/FE/FLAME1), eddy's bvec-rotation↔resampling consistency and
field units end-to-end, MCFLIRT, spline interpolation, the dtifit linear chain, and
BET2's evolution equations. Harnesses for the cleared suspects are in
verified-correct/.
Part of a larger project auditing the open-source software that published science runs: a full-text survey of six high-impact journals, followed by targeted source review of the most-used packages. The survey, the FSL component reviews these reports are drawn from, and the parallel FreeSurfer audit (5 fix PRs, filed on GitHub) all live in research-software-audit. "Exposed" in these reports means a paper used the affected feature/version — not that its conclusions are wrong. None of the findings has yet been reproduced by running FSL binaries on imaging data; verification is at the level of the routines themselves (compiled verbatim, ported faithfully, or simulated).
FSL is distributed under a non-commercial license; no FSL source is redistributed here — patches and harnesses only.