Dear Maintainer,

Sometimes aptitude makes bad choices when safe-upgrade is used, the problem
is probably in the aptitude resolver. Here is an example of this happening:

$ sudo aptitude safe-upgrade linux-headers-amd64
Resolving dependencies...
The following NEW packages will be installed:
  linux-headers-6.3.0-1-amd64{a} linux-headers-6.3.0-1-common{a} linux-
kbuild-6.3:i386{a}
The following packages will be upgraded:
  linux-headers-amd64
1 packages upgraded, 3 newly installed, 0 to remove and 33 not upgraded.
Need to get 0 B/12.0 MB of archives. After unpacking 63.8 MB will be used.

Here aptitude wants to install linux-kbuild-6.3:i386 instead of
linux-kbuild-6.3:amd64. If I switch to using full-upgrade I get the following:

$ sudo aptitude full-upgrade linux-headers-amd64
The following NEW packages will be installed:
  linux-doc-6.3{a} linux-headers-6.3.0-1-amd64{a} linux-
headers-6.3.0-1-common{a}
  linux-image-6.3.0-1-amd64{a} linux-kbuild-6.3{a}
The following packages will be upgraded:
  libcpupower1 linux-cpupower linux-doc linux-headers-amd64 linux-image-amd64
linux-libc-dev
6 packages upgraded, 5 newly installed, 0 to remove and 28 not upgraded.
Need to get 914 kB/124 MB of archives. After unpacking 718 MB will be used.

This actually caused a dkms module to stop compiling:

DKMS make.log for it87-20230126 for kernel 6.3.0-1-amd64 (x86_64)
Thu 15 Jun 2023 14:12:15 AEST
  CC [M]  /var/lib/dkms/it87/20230126/build/it87.o
  MODPOST /var/lib/dkms/it87/20230126/build/Module.symvers
FATAL: modpost: /var/lib/dkms/it87/20230126/build/it87: sizeof(struct
dmi_device_id)=332 is not a modulo of the size of section
__mod_dmi__<identifier>_device_table=7224.
Fix definition of struct dmi_device_id in mod_devicetable.h
make[2]: *** [/usr/src/linux-
headers-6.3.0-1-common/scripts/Makefile.modpost:136:
/var/lib/dkms/it87/20230126/build/Module.symvers] Error 1
make[1]: *** [/usr/src/linux-headers-6.3.0-1-common/Makefile:2002: modpost]
Error 2
make: *** [Makefile:73: modules] Error 2

After changing linux-kbuild to amd64 the module builds correctly again:

Building module:
Cleaning build area...
make -j12 KERNELRELEASE=6.3.0-1-amd64 TARGET=6.3.0-1-amd64...
Signing module /var/lib/dkms/it87/20230126/build/it87.ko
Cleaning build area...

it87.ko:
Running module version sanity check.
 - Original module
 - Installation
   - Installing to /lib/modules/6.3.0-1-amd64/updates/dkms/
depmod...
Sign command: /usr/lib/linux-kbuild-6.3/scripts/sign-file
Signing key: /var/lib/dkms/mok.key
Public certificate (MOK): /var/lib/dkms/mok.pub

A Debian user in #debian-apt suggested I try pinning the i386 architecture to
400 but this had no effect on aptitude's resolver choices. The concern here
being in what ways could aptitude break a Debian install if it decides to
install foreign packages over native ones?

Dear Maintainer,

This bug is now happening every time a new kernel version comes to the
repositories. It really doesn't feel like safe-upgrade is the correct
name for this parameter when it is pulling in a foreign architecture
package that breaks building some kernel modules. Could someone please
have a look at this? Again here is the output of my safe-upgrade
command:

$ sudo aptitude -sv safe-upgrade
Resolving dependencies...
The following NEW packages will be installed:
  linux-compiler-gcc-13-x86{a} linux-doc-6.4{a} linux-headers-6.4.0-1-amd64{a}
  linux-headers-6.4.0-1-common{a} linux-image-6.4.0-1-amd64{a}
linux-kbuild-6.4.0-1:i386{a}
The following packages will be upgraded:
  gir1.2-gtk-3.0 gtk-3-examples gtk-update-icon-cache libcpupower1
libglib2.0-0 libglib2.0-0:i386
  libglib2.0-bin libglib2.0-data libglib2.0-dev libglib2.0-dev-bin
libgoa-1.0-0b libgoa-1.0-common
  libgtk-3-0 libgtk-3-bin libgtk-3-common libgtk-3-dev libkpathsea6
libncurses6 libncurses6:i386
  libncursesw6 libncursesw6:i386 libptexenc1 libqt6core6 libqt6dbus6
libqt6gui6 libqt6network6
  libqt6opengl6 libqt6openglwidgets6 libqt6printsupport6 libqt6qml6
libqt6qmlmodels6 libqt6quick6
  libqt6quickwidgets6 libqt6sql6 libqt6sql6-ibase libqt6sql6-mysql
libqt6sql6-odbc libqt6sql6-psql
  libqt6sql6-sqlite libqt6test6 libqt6widgets6 libqt6xml6 libsynctex2
libtexlua53-5 libtexluajit2
  libtinfo6 libtinfo6:i386 libudisks2-0 linux-cpupower linux-doc
linux-headers-amd64 linux-image-amd64
  linux-libc-dev ncurses-base ncurses-bin python3-charset-normalizer
python3-gi python3-gi-cairo
  python3-pluggy python3-typing-extensions qt6-gtk-platformtheme
qt6-image-formats-plugins
  qt6-qpa-plugins texlive-binaries udisks2
65 packages upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 169 MB of archives. After unpacking 724 MB will be used.

Note: Using 'Simulate' mode.
Do you want to continue? [Y/n/?] n
Abort.

Dear Maintainer,

The following workaround seems to help:

/etc/apt/preferences

Package: linux-kbuild-*:i386
Pin: release o=Debian
Pin-Priority: -1

Before doing the workaround:

$ sudo aptitude safe-upgrade linux-image-amd64 linux-headers-amd64
Resolving dependencies...
The following NEW packages will be installed:
  linux-headers-6.5.0-2-amd64{a} linux-headers-6.5.0-2-common{a} linux-
image-6.5.0-2-amd64{a}
  linux-kbuild-6.5.0-2:i386{a}
The following packages will be upgraded:
  linux-headers-amd64 linux-image-amd64
2 packages upgraded, 4 newly installed, 0 to remove and 71 not upgraded.
Need to get 87.8 MB of archives. After unpacking 540 MB will be used.
Do you want to continue? [Y/n/?]

After doing the workaround:

$ sudo aptitude safe-upgrade linux-image-amd64 linux-headers-amd64
Resolving dependencies...
The following NEW packages will be installed:
  linux-headers-6.5.0-2-amd64{a} linux-headers-6.5.0-2-common{a} linux-
image-6.5.0-2-amd64{a}
  linux-kbuild-6.5.0-2{a}
The following packages will be upgraded:
  linux-headers-amd64 linux-image-amd64
2 packages upgraded, 4 newly installed, 0 to remove and 71 not upgraded.
Need to get 87.8 MB of archives. After unpacking 540 MB will be used.
Do you want to continue? [Y/n/?]