DOG-018: fuzz the repo-supplied config parsers (CFG / SUBS / IGNO)

Now: OPEN

dog/git/CFG.c (gitconfig-family ragel), dog/git/SUBS.c (.gitmodules) and dog/git/IGNO.c (.gitignore chain) all parse files that arrive verbatim from a cloned, untrusted repository, yet dog/fuzz/ has no target for any of them — they only get happy-path unit tests (test/CFG.c, test/IGNO.c). DOG-015 (IGNOGlob ReDoS) is exactly the class a fuzzer would have caught. Method: Issues.

Input

Context

Untrusted inputs: .git/config-family via CFGu8sFeed/CFGu8sDrain, .gitmodules via SUBSu8sParse/SUBSu8sFind, .gitignore via IGNOLoad/IGNOMatch/IGNOFree — every clone/status walks these.
dog/fuzz/PACKRESOLVE.c is the house pattern: bounded input, BASS carves in a per-probe call() frame, errors expected, only faults surface.

Goals

Three targets in dog/fuzz/: CFGfuzz, SUBSfuzz, IGNOfuzz, wired into dog/fuzz/CMakeLists.txt, built with WITH_FUZZ + ASan.
Invariants: no crash/OOB/leak; all yielded slices in-bounds of the input; CFGu8sFeed terminates and consumes monotonically; SUBS cb gets $ok path/url slices; IGNOMatch returns within a step budget (libFuzzer -timeout as the hang oracle until DOG-015 lands the budget).
A short local run (≥1M execs or 10 min each) comes back clean, seeded from test/data + real-world config/gitmodules/gitignore samples.

Constraints

Harness-only ticket: no parser edits; any crash/hang found is filed as its own ticket and linked here (per todo.mkd), not silently fixed.
ABC style throughout; input caps like the existing fuzzers (≤64 KiB).

WIP

TODOs

T1 CFGfuzz: drive CFGstate feed/drain to exhaustion, slice bounds checks.
T2 SUBSfuzz: parse + SUBSu8sFind a fuzzed name; cb slice invariants.
T3 IGNOfuzz: split input into chain files + a path; Load/Match/Free cycle.
T4 CMakeLists wiring + seed corpus dirs; note run commands in this ticket.

Blockers and bummers

2026-07-12: T1-T4 implemented in worktree ~/src/DOG-018 (fuzz/CFG.c, fuzz/SUBS.c, fuzz/IGNO.c, CMake wiring, seeded corpora), UNLANDED. Orchestrator-verified: only fuzz/CMakeLists.txt modified among tracked files; CFGfuzz/SUBSfuzz re-run clean (7.9M/3.0M execs per 60 s).
FOUND a real fd leak: IGNOFree (git/IGNO.c:297) frees a FILEMapRO mapping with u8bUnMap (munmap only) instead of FILEUnMap (unmap + close of the booked fd) — one fd leaked per mapped .gitignore; verified at source + empirically (run dies "No file descriptors available"). Candidate ticket, NOT fixed here (harness-only rule).
A sustained ≥5 min IGNOfuzz run is impossible until that leak lands a fix; CFG/SUBS ran the full 300 s clean (18.8M / 8.8M execs).
LSan is unavailable under this sandbox (ptrace/proc limits) — fd leak was caught by exhaustion, heap leaks not machine-checked.

Outcome

OPEN — filed 2026-07-12, fuzz-coverage review of dog/fuzz.