DOG-019: GITfuzz + DELTfuzz — git object drains and the delta applier

Now: OPEN

dog/git/GIT.c drains tree entries, commit headers and refnames straight off remote pack bytes, and dog/git/DELT.c::DELTApply applies delta instruction streams — git's classic CVE alley. Today only the OFS delta chase (PACKResolveOfs, dog/fuzz/PACKRESOLVE.c) is fuzzed; the applier alone and the drains have no targets. Method: Issues.

Input

Context

GITu8sDrainTree/GITu8sFileSplit, GITu8sDrainCommit/GITParseCommit/ GITu8sIdent, GITParseRef/GITFeedRef, PKTu8sDrain — all consume attacker-controlled bytes (pack objects, wire pkt-lines, refnames).
DELTApply(base, delta, out) copy/insert opcodes index into base and size out; PACKRESOLVEfuzz reaches it only through well-framed packs.
DOG-014 (PACKResolveOfs ping-pong sizing) is adjacent context; don't duplicate its scope here.

Goals

GITfuzz: one target looping each drain to exhaustion over the raw input (first byte selects the drain); invariants: no crash/OOB, out-slices in-bounds, drains consume monotonically (no infinite loop).
DELTfuzz: split input into (base, delta), DELTApply into a bounded buffer — corrupt streams must yield an error, never a fault; plus the round-trip oracle DELTApply(a, DELTEncode(a,b)) == b on split inputs.
Both wired into dog/fuzz/CMakeLists.txt; ≥1M execs / 10 min clean under ASan; seeds from real git objects (test/data, a .keeper log).

Constraints

Harness-only: parser/applier bugs found become their own tickets, linked both ways (per todo.mkd); ABC style; follow PACKRESOLVE.c structure.

WIP

TODOs

T1 GITfuzz: selector byte + drain loops for tree/commit/ident/ref/pkt.
T2 DELTfuzz: adversarial apply + encode/apply round-trip property.
T3 CMakeLists wiring + seed corpora; note run commands in this ticket.

Blockers and bummers

2026-07-12: T1-T3 implemented in worktree ~/src/DOG-019 (fuzz/GIT.c selector-byte drains, fuzz/DELT.c adversarial apply + encode/apply round-trip oracle, CMake wiring, 14+5 seed corpora), UNLANDED. Orchestrator-verified: only fuzz/CMakeLists.txt modified among tracked files; both targets re-run clean 60 s each, zero artifacts.
5-min campaigns clean: GITfuzz 15.8M execs, DELTfuzz 2.8M execs, no findings — no crash, no OOB out-slice, no round-trip mismatch.
DELT round-trip gated to ≤8 KiB halves for exec rate; larger blobs unexercised by the property (adversarial apply runs to 256 KiB).

Outcome

OPEN — filed 2026-07-12, fuzz-coverage review of dog/fuzz.