GIT-025: `PACKRecordEnd` carves `obj.size` straight off the wire — unbounded scratch

Now: OPEN
Sev: MED

PACKRecordEnd (dog/git/PACK.c:184-202) measures a record's extent by inflating it into BASS scratch sized a_carve(u8, sc, obj.size) — and obj.size is the record's own untrusted varint, up to ~2^60. One corrupt or hostile record demands an arbitrary carve: OOM/DoS at every scan site (PIDXScan per record, the js binding via GIT-007). Found in the 2026-07-24 dog/git review. Method: work.

Input

Context

dog/git/PACK.c:197 — a_carve(u8, sc, obj.size ? obj.size : 1); the varint decoder (PACKDrainVarint) happily yields huge sizes.
zlib's max compression ratio is ~1032:1, so a genuine record's inflated size is bounded by (packlen - offset) * 1032 — anything above that is corruption by construction, rejectable BEFORE carving.
Interplay with GIT-011: today's ZINFInflate output-wrap is what makes "inflate into a too-small buffer" survivable-but-corrupting; once GIT-011 lands a NOROOM error, a chunked measure loop (fixed small carve, count total_out) becomes the clean way to size-check.

Goals

A record declaring an absurd size returns PACKBADFMT (bounded error), never a giant carve. Honest packs measure byte-identically.
Repro-first: a crafted header declaring e.g. 2^40 bytes — today it attempts a 1TB carve; expect the bounded error instead.

Constraints

dog/git libdog, ABC style; BASS carve rules (abc.mkd §BASS) — the carve stays in the op's own frame.
PIDXScan / keeper scan callers and their tests stay green.

WIP

Design decisions

Cheapest fix: test(obj.size <= (packlen - offset) * 1032ULL, PACKBADFMT) before the carve (watch the multiply overflow — clamp first). The chunked-measure rewrite can ride with GIT-011.

TODOs

Repro test in dog/test/ (absurd declared size → bounded error).
Land the pre-carve bound; ctest green.
After GIT-011: consider chunked measuring to drop the big carve entirely (also fixes lying-size records corrupting the measure).

Blockers and bummers

None known; the full chunked-measure path is blocked on GIT-011.
Repro proved the damage: a declared 2^28 over a ~50-byte record returned OK today after a 256MB carve (one wire varint eats a quarter of BASS, once per scanned record); 2^40 died as BNOROOM — the arena's error, not the format's.

Outcome

Worker run 07Aug26: fix staged in //GIT-025 on base 06a2a21d (orchestrator-verified, not landed). git/PACK.c pre-carve bound (obj.size <= left * PACK_ZLIB_MAX_RATIO, clamped multiply), git/PACK.h PACK_ZLIB_MAX_RATIO 1032, new test/PACKEND.c (honest_walk / absurd_size / plausible_lie / within_ratio) + CMake row. ctest 77/77 green.
Suggested commit: GIT-025: bound declared record size before carving

GIT-025: PACKRecordEnd carves obj.size straight off the wire — unbounded scratch