diff --git a/Makefile b/Makefile
index 883408b5..99602dff 100644
--- a/Makefile
+++ b/Makefile
@@ -210,8 +210,8 @@ $(BIN) $(LIB) $(OBJ)/wcc $(OBJ)/ww $(OBJ)/wwdump $(OBJ)/w6c $(OBJ)/w6a $(OBJ)/w6
 # ---- tests -------------------------------------------------------------
 # Each phase adds a $(BIN)/test_<name> target; the runner walks them.
 TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
-	  $(BIN)/test_w6c $(BIN)/test_w6a $(BIN)/test_dataw $(BIN)/test_w6l \
-	  $(BIN)/test_data_link \
+	  $(BIN)/test_w6c $(BIN)/test_w6a $(BIN)/test_dataw $(BIN)/test_datar \
+	  $(BIN)/test_w6l $(BIN)/test_data_link \
 	  $(BIN)/test_arch \
 	  $(BIN)/test_e2e $(BIN)/test_ffi $(BIN)/test_dyn $(BIN)/test_stdlib \
 	  $(BIN)/test_at_test $(BIN)/test_let_global \
@@ -240,6 +240,9 @@ $(BIN)/test_w6a: test/wcc/500_w6a.c $(BIN)/w6c $(BIN)/w6a | $(BIN)
 $(BIN)/test_dataw: test/wcc/510_dataw.c $(BIN)/w6a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_datar: test/wcc/520_datar.c $(BIN)/w6a $(BIN)/w6l | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_w6l: test/wcc/600_w6l.c $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
diff --git a/cmd/w6a/a.h b/cmd/w6a/a.h
index b141a564..32c4cf40 100644
--- a/cmd/w6a/a.h
+++ b/cmd/w6a/a.h
@@ -60,8 +60,9 @@ struct Asym {
 };
 
 struct Areloc {
-	u64	off;	/* offset within .text where relocation lands */
-	int	kind;	/* R_X86_64_PLT32 (4), R_X86_64_PC32 (2) */
+	u64	off;	/* offset within the relocation's section */
+	int	section;/* 0 = .text (most relocs), 1 = .data (DATAR) */
+	int	kind;	/* R_X86_64_64 (1), R_X86_64_PC32 (2), R_X86_64_PLT32 (4) */
 	Asym	*sym;
 	i64	addend;
 	Areloc	*next;
@@ -111,5 +112,6 @@ void	a_emit_byte(Asm*, u8);
 void	a_emit_u32(Asm*, u32);
 void	a_emit_data_byte(Asm*, u8);
 void	a_addreloc(Asm*, u64 off, int kind, Asym *s, i64 add);
+void	a_addreloc_data(Asm*, u64 off, int kind, Asym *s, i64 add);
 
 #endif
diff --git a/cmd/w6a/asm.c b/cmd/w6a/asm.c
index 577da513..ca4746e4 100644
--- a/cmd/w6a/asm.c
+++ b/cmd/w6a/asm.c
@@ -70,6 +70,23 @@ a_addreloc(Asm *a, u64 off, int kind, Asym *s, i64 add)
 {
 	Areloc *r = calloc(1, sizeof *r);
 	r->off = off;
+	r->section = 0;	/* .text */
+	r->kind = kind;
+	r->sym = s;
+	r->addend = add;
+	r->next = a->relocs;
+	a->relocs = r;
+}
+
+/* Record a relocation that lives in the .data section. Used by
+ * DATAR to patch a 64-bit slot with a symbol's runtime VA. obj.c
+ * separates these into .rela.data when emitting the .o. */
+void
+a_addreloc_data(Asm *a, u64 off, int kind, Asym *s, i64 add)
+{
+	Areloc *r = calloc(1, sizeof *r);
+	r->off = off;
+	r->section = 1;	/* .data */
 	r->kind = kind;
 	r->sym = s;
 	r->addend = add;
@@ -335,6 +352,26 @@ a_encode(Asm *a)
 				a_emit_data_byte(a, p->bytes[i]);
 			break;
 		}
+		case A_DATAR: {
+			/* DATAR slot+off(SB), target(SB) — record an
+			 * R_X86_64_64 relocation at slot+off in .data
+			 * pointing at target. The slot must already be
+			 * defined by a prior DATAW (which emitted zero
+			 * placeholder bytes the linker will overwrite). */
+			Asym *holder = a_intern(a, p->from.sym);
+			if (!holder->defined || !holder->is_data) {
+				fprintf(stderr,
+				    "w6a: line %d: DATAR slot %s not yet defined as DATAW\n",
+				    p->line, p->from.sym);
+				a->errs++;
+				break;
+			}
+			Asym *target = a_intern(a, p->to.sym);
+			u64 reloff = holder->addr + (u64)p->from.offset;
+			a_addreloc_data(a, reloff, 1 /* R_X86_64_64 */,
+			    target, 0);
+			break;
+		}
 		case A_RET:
 			a_emit_byte(a, 0xC3);
 			break;
diff --git a/cmd/w6a/obj.c b/cmd/w6a/obj.c
index f7a402ca..3088ece5 100644
--- a/cmd/w6a/obj.c
+++ b/cmd/w6a/obj.c
@@ -111,27 +111,42 @@ typedef struct {
 int
 a_emit_elf(Asm *a, FILE *f)
 {
-	Buf shstr = {0}, str = {0}, sym = {0}, rela = {0};
+	Buf shstr = {0}, str = {0}, sym = {0}, rela = {0}, relad = {0};
 	stput(&shstr, "");	/* idx 0 = empty */
 	stput(&str, "");
 
 	const int has_data = (a->datalen > 0);
+	int has_data_relocs = 0;
+	for (Areloc *r = a->relocs; r; r = r->next) {
+		if (r->section == 1) { has_data_relocs = 1; break; }
+	}
 
 	/* Section indices.
-	 * Without data: 1=.text, 2=.rela.text, 3=.symtab, 4=.strtab, 5=.shstrtab
-	 * With data:    1=.text, 2=.rela.text, 3=.data, 4=.symtab, 5=.strtab, 6=.shstrtab
+	 * Without data, without data-relocs:
+	 *   1=.text, 2=.rela.text, 3=.symtab, 4=.strtab, 5=.shstrtab
+	 * With data, no data-relocs:
+	 *   1=.text, 2=.rela.text, 3=.data, 4=.symtab, 5=.strtab, 6=.shstrtab
+	 * With data + data-relocs:
+	 *   1=.text, 2=.rela.text, 3=.data, 4=.rela.data, 5=.symtab,
+	 *   6=.strtab, 7=.shstrtab
 	 */
 	const u16 SH_TEXT   = 1;
 	const u16 SH_DATA   = has_data ? 3 : 0;
-	const u16 SH_SYMTAB = has_data ? 4 : 3;
-	const u16 SH_STRTAB = has_data ? 5 : 4;
-	const u16 SH_SHSTR  = has_data ? 6 : 5;
+	const u16 SH_RELAD  = (has_data && has_data_relocs) ? 4 : 0;
+	const u16 SH_SYMTAB = has_data
+	    ? (has_data_relocs ? 5 : 4)
+	    : 3;
+	const u16 SH_STRTAB = (u16)(SH_SYMTAB + 1);
+	const u16 SH_SHSTR  = (u16)(SH_STRTAB + 1);
 
 	/* Section name offsets. Append .data's name only when used so the
-	 * .shstrtab buffer stays byte-identical for the no-DATAW case. */
+	 * .shstrtab buffer stays byte-identical for the no-DATAW case.
+	 * Same for .rela.data — only present when data relocs exist. */
 	u32 shn_text	  = stput(&shstr, ".text");
 	u32 shn_rela	  = stput(&shstr, ".rela.text");
 	u32 shn_data	  = has_data ? stput(&shstr, ".data") : 0;
+	u32 shn_relad	  = (has_data && has_data_relocs)
+	    ? stput(&shstr, ".rela.data") : 0;
 	u32 shn_symtab	  = stput(&shstr, ".symtab");
 	u32 shn_strtab	  = stput(&shstr, ".strtab");
 	u32 shn_shstrtab  = stput(&shstr, ".shstrtab");
@@ -168,13 +183,14 @@ a_emit_elf(Asm *a, FILE *f)
 		s->idx = idx++;
 	}
 
-	/* Build relocations */
+	/* Build relocations — split into two buffers so we can emit
+	 * .rela.text and (conditionally) .rela.data separately. */
 	for (Areloc *r = a->relocs; r; r = r->next) {
 		Rela64 re;
 		re.r_offset = r->off;
 		re.r_info = ELF64_R_INFO((u64)r->sym->idx, (u64)r->kind);
 		re.r_addend = r->addend;
-		bput(&rela, &re, sizeof re);
+		bput(r->section == 1 ? &relad : &rela, &re, sizeof re);
 	}
 
 	/* Layout offsets in the file */
@@ -182,13 +198,16 @@ a_emit_elf(Asm *a, FILE *f)
 	u64 off_text = off; off += a->textlen;
 	u64 off_rela = off; off += rela.n;
 	u64 off_data = off; if (has_data) off += a->datalen;
+	u64 off_relad = off; if (has_data && has_data_relocs) off += relad.n;
 	u64 off_sym  = off; off += sym.n;
 	u64 off_str  = off; off += str.n;
 	u64 off_shstr= off; off += shstr.n;
 	/* align to 8 */
 	while (off % 8) off++;
 	u64 off_shdr = off;
-	const int NSECT = has_data ? 7 : 6;	/* null + reals */
+	const int NSECT = has_data
+	    ? (has_data_relocs ? 8 : 7)
+	    : 6;	/* null + reals */
 
 	Ehdr eh = {0};
 	memcpy(eh.e_ident, "\x7f""ELF", 4);
@@ -208,6 +227,7 @@ a_emit_elf(Asm *a, FILE *f)
 	if (a->textlen) fwrite(a->text, 1, a->textlen, f);
 	fwrite(rela.p, 1, rela.n, f);
 	if (has_data) fwrite(a->data, 1, a->datalen, f);
+	if (has_data && has_data_relocs) fwrite(relad.p, 1, relad.n, f);
 	fwrite(sym.p, 1, sym.n, f);
 	fwrite(str.p, 1, str.n, f);
 	fwrite(shstr.p, 1, shstr.n, f);
@@ -249,6 +269,20 @@ a_emit_elf(Asm *a, FILE *f)
 		fwrite(&sh, 1, sizeof sh, f);
 	}
 
+	if (has_data && has_data_relocs) {
+		memset(&sh, 0, sizeof sh);
+		sh.sh_name = shn_relad;
+		sh.sh_type = SHT_RELA;
+		sh.sh_flags = SHF_INFO_LINK;
+		sh.sh_offset = off_relad;
+		sh.sh_size = relad.n;
+		sh.sh_link = SH_SYMTAB;
+		sh.sh_info = SH_DATA;	/* applies to .data */
+		sh.sh_addralign = 8;
+		sh.sh_entsize = sizeof(Rela64);
+		fwrite(&sh, 1, sizeof sh, f);
+	}
+
 	memset(&sh, 0, sizeof sh);
 	sh.sh_name = shn_symtab;
 	sh.sh_type = SHT_SYMTAB;
@@ -276,6 +310,6 @@ a_emit_elf(Asm *a, FILE *f)
 	sh.sh_addralign = 1;
 	fwrite(&sh, 1, sizeof sh, f);
 
-	free(shstr.p); free(str.p); free(sym.p); free(rela.p);
+	free(shstr.p); free(str.p); free(sym.p); free(rela.p); free(relad.p);
 	return 0;
 }
diff --git a/cmd/w6a/parse.c b/cmd/w6a/parse.c
index 94e9f7da..a52bfe74 100644
--- a/cmd/w6a/parse.c
+++ b/cmd/w6a/parse.c
@@ -121,6 +121,7 @@ opcode_lookup(const char *m)
 		{ "TEXT", A_TEXT },
 		{ "DATA", A_DATA },
 		{ "DATAW", A_DATAW },
+		{ "DATAR", A_DATAR },
 		{ NULL, 0 }
 	};
 	for (int i = 0; tab[i].m; i++)
@@ -211,6 +212,17 @@ parse_operand(Asm *a, const char *s, Aoperand *out)
 		while (a_isidcont((unsigned char)*s) && n < 63) buf[n++] = *s++;
 		buf[n] = 0;
 
+		/* Optional `+disp` between the ident and `(SB)`. Used by
+		 * DATAR to address bytes inside an existing .data slot
+		 * (e.g. `DATAR s+8(SB),...`). */
+		i64 sym_disp = 0;
+		if (*s == '+') {
+			s++;
+			char *end;
+			sym_disp = a_parsenum(s, &end);
+			s = end;
+		}
+
 		/* ID(SB) means external symbol */
 		if (*s == '(') {
 			char rbuf[8] = {0};
@@ -223,6 +235,7 @@ parse_operand(Asm *a, const char *s, Aoperand *out)
 			if (r == D_PSB) {
 				out->type = D_EXTERN;
 				out->sym = strdup(buf);
+				out->offset = sym_disp;
 				return 0;
 			}
 			out->type = D_INDIR;
diff --git a/cmd/w6c/6.out.h b/cmd/w6c/6.out.h
index 5d53d6a6..d7eeb27f 100644
--- a/cmd/w6c/6.out.h
+++ b/cmd/w6c/6.out.h
@@ -41,6 +41,9 @@ enum {
 	A_TEXT,
 	A_DATA,
 	A_DATAW,	/* writable DATA: lands in .data (RW) instead of .text */
+	A_DATAR,	/* reloc-only: patch a 64-bit slot in .data with a
+			 * symbol's runtime VA. Pairs with a prior DATAW
+			 * that left zero placeholder bytes. */
 	A_GLOBL,
 	A_END,
 
diff --git a/cmd/w6c/txt.c b/cmd/w6c/txt.c
index ad9863f5..1f3e8719 100644
--- a/cmd/w6c/txt.c
+++ b/cmd/w6c/txt.c
@@ -26,6 +26,7 @@ anames(int op)
 	case A_TEXT:	return "TEXT";
 	case A_DATA:	return "DATA";
 	case A_DATAW:	return "DATAW";
+	case A_DATAR:	return "DATAR";
 	case A_GLOBL:	return "GLOBL";
 	case A_END:	return "END";
 	case A_MOVQ:	return "MOVQ";
diff --git a/cmd/w6l/l.h b/cmd/w6l/l.h
index fdf81986..99e4dcbd 100644
--- a/cmd/w6l/l.h
+++ b/cmd/w6l/l.h
@@ -48,7 +48,8 @@ struct Lsym {
 };
 
 struct Lrel {
-	u64	off;		/* offset within combined .text */
+	u64	off;		/* offset within the relocation's section */
+	int	section;	/* 0 = .text, 1 = .data */
 	int	kind;		/* R_X86_64_* */
 	Lsym	*sym;
 	i64	addend;
diff --git a/cmd/w6l/obj.c b/cmd/w6l/obj.c
index 916785f3..928faf79 100644
--- a/cmd/w6l/obj.c
+++ b/cmd/w6l/obj.c
@@ -278,9 +278,10 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 	if (eh->e_shstrndx >= eh->e_shnum) { free(buf); return -1; }
 	const char *shstr = (const char *)(buf + sh[eh->e_shstrndx].sh_offset);
 
-	/* find .text, .data (optional), .symtab, .strtab, .rela.text */
+	/* find .text, .data (optional), .symtab, .strtab, .rela.text,
+	 * .rela.data (optional) */
 	int idx_text = -1, idx_data = -1, idx_symtab = -1, idx_strtab = -1;
-	int idx_rela = -1;
+	int idx_rela = -1, idx_relad = -1;
 	for (u16 i = 0; i < eh->e_shnum; i++) {
 		const char *nm = shstr + sh[i].sh_name;
 		if (sh[i].sh_type == SHT_PROGBITS && strcmp(nm, ".text") == 0)
@@ -291,6 +292,8 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 			idx_symtab = i;
 		else if (sh[i].sh_type == SHT_RELA && strcmp(nm, ".rela.text") == 0)
 			idx_rela = i;
+		else if (sh[i].sh_type == SHT_RELA && strcmp(nm, ".rela.data") == 0)
+			idx_relad = i;
 	}
 	if (idx_text < 0 || idx_symtab < 0) {
 		fprintf(stderr, "w6l: %s: missing .text or .symtab\n", path);
@@ -356,6 +359,25 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
 		for (u64 i = 0; i < nrel; i++) {
 			Lrel *r = calloc(1, sizeof *r);
 			r->off = ob->text_off + rt[i].r_offset;
+			r->section = 0;
+			r->kind = (int)ELF64_R_TYPE(rt[i].r_info);
+			u32 sidx = ELF64_R_SYM(rt[i].r_info);
+			r->sym = (sidx < nsyms) ? map[sidx] : NULL;
+			r->addend = rt[i].r_addend;
+			r->next = l->rels;
+			l->rels = r;
+		}
+	}
+	/* per-object: collect data relocations from .rela.data. The
+	 * .data section in the .o starts at a per-object 0; we shift
+	 * by ob->data_off so r->off indexes the combined .data buffer. */
+	if (idx_relad >= 0) {
+		Rela64 *rt = (Rela64 *)(buf + sh[idx_relad].sh_offset);
+		u64 nrel = sh[idx_relad].sh_size / sizeof(Rela64);
+		for (u64 i = 0; i < nrel; i++) {
+			Lrel *r = calloc(1, sizeof *r);
+			r->off = ob->data_off + rt[i].r_offset;
+			r->section = 1;
 			r->kind = (int)ELF64_R_TYPE(rt[i].r_info);
 			u32 sidx = ELF64_R_SYM(rt[i].r_info);
 			r->sym = (sidx < nsyms) ? map[sidx] : NULL;
diff --git a/cmd/w6l/pass.c b/cmd/w6l/pass.c
index 8dabe675..02dcc093 100644
--- a/cmd/w6l/pass.c
+++ b/cmd/w6l/pass.c
@@ -13,6 +13,7 @@
 #include <stdio.h>
 #include <string.h>
 
+#define R_X86_64_64	1
 #define R_X86_64_PC32	2
 #define R_X86_64_PLT32	4
 
@@ -67,6 +68,13 @@ patch_u32(u8 *p, u32 v)
 	p[3] = (u8)((v >> 24) & 0xff);
 }
 
+static void
+patch_u64(u8 *p, u64 v)
+{
+	for (int i = 0; i < 8; i++)
+		p[i] = (u8)((v >> (i * 8)) & 0xff);
+}
+
 int
 l_relocate(Lnk *l, u64 text_va, u64 data_va)
 {
@@ -76,17 +84,31 @@ l_relocate(Lnk *l, u64 text_va, u64 data_va)
 		 * PLT's virtual address is known. */
 		if (r->sym->is_dyn) continue;
 		if (!r->sym->defined) continue;
+		u64 sym_va = r->sym->in_data
+		    ? data_va + r->sym->val
+		    : text_va + r->sym->val;
 		switch (r->kind) {
 		case R_X86_64_PC32:
 		case R_X86_64_PLT32: {
+			/* PC-relative 32-bit displacement; lands in .text. */
 			u64 site = text_va + r->off;
-			u64 sym_va = r->sym->in_data
-			    ? data_va + r->sym->val
-			    : text_va + r->sym->val;
 			i64 rel = (i64)sym_va - (i64)site + r->addend;
 			patch_u32(l->text + r->off, (u32)(i32)rel);
 			break;
 		}
+		case R_X86_64_64: {
+			/* Absolute 64-bit: patch the 8-byte slot at the
+			 * given offset within the section. Currently only
+			 * used for data slots holding symbol addresses
+			 * (DATAR). */
+			u64 v = (u64)((i64)sym_va + r->addend);
+			if (r->section == 1) {
+				patch_u64(l->data + r->off, v);
+			} else {
+				patch_u64(l->text + r->off, v);
+			}
+			break;
+		}
 		default:
 			fprintf(stderr, "w6l: unsupported reloc kind %d\n",
 			    r->kind);
diff --git a/test/wcc/520_datar.c b/test/wcc/520_datar.c
new file mode 100644
index 00000000..fe7e0f48
--- /dev/null
+++ b/test/wcc/520_datar.c
@@ -0,0 +1,194 @@
+/*
+ * 520_datar — DATAR reloc smoke. Assemble + link a tiny .s that
+ * uses DATAR to patch a .data slot with a symbol's runtime VA,
+ * then run the binary and confirm the linker filled the slot
+ * correctly: the program prints "hello" via the relocated pointer
+ * and exits 0.
+ *
+ * Also confirms the .o has a `.rela.data` section with one
+ * R_X86_64_64 entry against the expected symbol — catches
+ * regressions where the asm emits DATAR but obj.c doesn't reach
+ * the writable-data reloc path.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+#define SHT_RELA	4
+#define R_X86_64_64	1
+
+#pragma pack(push, 1)
+typedef struct {
+	uint8_t  e_ident[16];
+	uint16_t e_type, e_machine;
+	uint32_t e_version;
+	uint64_t e_entry, e_phoff, e_shoff;
+	uint32_t e_flags;
+	uint16_t e_ehsize, e_phentsize, e_phnum, e_shentsize, e_shnum, e_shstrndx;
+} Ehdr;
+
+typedef struct {
+	uint32_t sh_name, sh_type;
+	uint64_t sh_flags, sh_addr, sh_offset, sh_size;
+	uint32_t sh_link, sh_info;
+	uint64_t sh_addralign, sh_entsize;
+} Shdr;
+
+typedef struct {
+	uint64_t r_offset;
+	uint64_t r_info;
+	int64_t  r_addend;
+} Rela64;
+#pragma pack(pop)
+
+static int
+run_exit(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+static int
+slurp(const char *path, uint8_t **out, size_t *outn)
+{
+	FILE *f = fopen(path, "rb");
+	if (!f) return -1;
+	fseek(f, 0, SEEK_END);
+	long n = ftell(f);
+	fseek(f, 0, SEEK_SET);
+	uint8_t *b = malloc((size_t)n);
+	if (fread(b, 1, (size_t)n, f) != (size_t)n) {
+		free(b); fclose(f); return -1;
+	}
+	fclose(f);
+	*out = b; *outn = (size_t)n;
+	return 0;
+}
+
+static const char *prog =
+    "TEXT _start,$0\n"
+    "\tMOVQ\t$1, AX\n"			/* write syscall */
+    "\tMOVQ\t$1, DI\n"			/* fd = 1 (stdout) */
+    "\tMOVQ\tpair(SB), SI\n"		/* ptr (relocated) */
+    "\tMOVQ\t$5, DX\n"			/* count = 5 */
+    "\tSYSCALL\n"
+    "\tMOVQ\t$60, AX\n"			/* exit */
+    "\tMOVQ\t$0, DI\n"
+    "\tSYSCALL\n"
+    "\n"
+    "DATAW pair(SB),\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+    "\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n"
+    "DATAR pair+0(SB),greeting(SB)\n"
+    "DATA greeting(SB),\"hello\"\n";
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+
+	char src[64], obj[64], exe[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/wwt_datar_%d.s", getpid());
+	snprintf(obj, sizeof obj, "/tmp/wwt_datar_%d.o", getpid());
+	snprintf(exe, sizeof exe, "/tmp/wwt_datar_%d.x", getpid());
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return 1;
+	fputs(prog, f);
+	fclose(f);
+
+	snprintf(cmd, sizeof cmd, "%s/w6a -o %s %s", bin, obj, src);
+	if (system(cmd) != 0) {
+		fprintf(stderr, "datar: w6a failed\n");
+		return 1;
+	}
+
+	int fail = 0;
+
+	/* Inspect the .o: there must be a .rela.data section with one
+	 * R_X86_64_64 entry against `greeting`. */
+	uint8_t *buf = NULL; size_t n = 0;
+	if (slurp(obj, &buf, &n) < 0) {
+		fprintf(stderr, "datar: cannot read .o\n");
+		fail++;
+		goto run_step;
+	}
+	const Ehdr *eh = (const Ehdr *)buf;
+	const Shdr *sh = (const Shdr *)(buf + eh->e_shoff);
+	const char *shstr = (const char *)(buf + sh[eh->e_shstrndx].sh_offset);
+	int idx_relad = -1, idx_strtab = -1, idx_symtab = -1;
+	for (uint16_t i = 0; i < eh->e_shnum; i++) {
+		const char *nm = shstr + sh[i].sh_name;
+		if (sh[i].sh_type == SHT_RELA && strcmp(nm, ".rela.data") == 0)
+			idx_relad = i;
+		if (sh[i].sh_type == 2 /* SHT_SYMTAB */)
+			idx_symtab = i;
+	}
+	if (idx_symtab >= 0)
+		idx_strtab = (int)sh[idx_symtab].sh_link;
+	if (idx_relad < 0) {
+		fprintf(stderr, "datar: .rela.data section missing\n");
+		fail++;
+	} else {
+		const Rela64 *rd = (const Rela64 *)(buf + sh[idx_relad].sh_offset);
+		uint64_t nrel = sh[idx_relad].sh_size / sizeof(Rela64);
+		if (nrel != 1) {
+			fprintf(stderr, "datar: .rela.data has %lu entries, want 1\n",
+			    (unsigned long)nrel);
+			fail++;
+		} else {
+			uint32_t kind = (uint32_t)(rd[0].r_info & 0xffffffff);
+			if (kind != R_X86_64_64) {
+				fprintf(stderr, "datar: reloc kind %u, want %d\n",
+				    kind, R_X86_64_64);
+				fail++;
+			}
+			if (rd[0].r_offset != 0) {
+				fprintf(stderr, "datar: reloc offset %lu, want 0\n",
+				    (unsigned long)rd[0].r_offset);
+				fail++;
+			}
+		}
+	}
+	free(buf);
+
+run_step:
+	snprintf(cmd, sizeof cmd, "%s/w6l -o %s %s", bin, exe, obj);
+	if (system(cmd) != 0) {
+		fprintf(stderr, "datar: w6l failed\n");
+		unlink(src); unlink(obj);
+		return 1;
+	}
+
+	/* Run: should print "hello" and exit 0. We pipe stdout to a
+	 * tmp file and check both the output and the exit code. */
+	char outf[64];
+	snprintf(outf, sizeof outf, "/tmp/wwt_datar_%d.out", getpid());
+	snprintf(cmd, sizeof cmd, "%s > %s", exe, outf);
+	int rc = run_exit(cmd);
+	if (rc != 0) {
+		fprintf(stderr, "datar: exit=%d, want 0\n", rc);
+		fail++;
+	}
+	uint8_t *out = NULL; size_t on = 0;
+	if (slurp(outf, &out, &on) < 0 || on != 5
+	    || memcmp(out, "hello", 5) != 0) {
+		fprintf(stderr, "datar: stdout != 'hello'\n");
+		fail++;
+	}
+	free(out);
+
+	unlink(src); unlink(obj); unlink(exe); unlink(outf);
+	if (fail) {
+		fprintf(stderr, "datar: %d check(s) failed\n", fail);
+		return 1;
+	}
+	printf("datar: ok\n");
+	(void)idx_strtab;
+	return 0;
+}