Store-format batch (2026-07-07 review). A crafted PACK trailer drives pointer construction via a wrapping u64; PACKClose leaks everything on an ENOSPC; the SLOG writer can emit skip records its own reader cannot expand; NESTFeed keeps copying after its mark log has eaten the room it checked.
PACK.c:189-216 PACKOpen — p->datalen = trailer[0] (untrusted);
datalen near u64max wraps (datalen + PAGESIZE - 1) → tiny npages
passes the idxsize == PACKIdxSize(npages) check with a matching
crafted idxsize; then buf[2] = buf[0] + datalen is a wild DATA
terminator — consumers read far OOB. Bound datalen against file size.PACK.c:120-144 PACKClose — call(PACKFlush), call(PACKWritePage),
two test(w == ...) all early-return before cleanup: ENOSPC at close
leaks fd + PAGE mapping + index mmap. PACKAbort exists; Close doesn't
use the wrapper+worker pattern (abc.mkd §Resource lifecycle).SLOG.c:22-27 vs SLOG.c:117 — writer clamps the flush count to 64
only when stack len ≥ 128, so 65..127-offset 'k' records are emittable;
reader expands into a_pad(u64, tmp, 64) → NOROOM on an intact log.
Writer cap and reader pad must agree.SLOG.c:214-218 SLOGu8sFeedSkips — reclen byte stored without a room
check: if ZINTu8sFeedBlocked fills the 1024 pad EXACTLY, the store is a
1-byte OOB stack write and fullbody[1] points past the pad. Overfill by
≥1 fails safely; only exact fill is unsafe.SLOG.h:88 vs SLOG.c:186 — decl says u8gp data, def says u8sp
into; compiles only because both erase to u8**. SLOG.md still
documents 'i'/SLOG_I and a $cmpfn seek; code has 'c'/SLOG_C + u8zs.NEST.c:96-115 NESTFeed — one up-front $len(idle) < $len(insert)
check, then per-char unchecked copies while NESTaddvar shrinks
idle[1] by 16 per variable (same cell as log[0]): literals + 16*nvars
over IDLE smashes stored mark128s; corrupted marks then drive
NESTRenderTree's a_part whose bound check is assert-only (NDEBUG →
wild-length OOB read). Once crossed, $size(idle) underflows and the
16-byte guard stops guarding.NEST.h:16 — NESTInsert declared, defined nowhere (INDEX.md:374
advertises it): link error for any caller. NEST.c:26 mark128 stores
are 16-byte-strided down from an unaligned buffer end — misaligned u64
stores, UBSan/strict-alignment trap.PAGE.c:235/253 PAGEStreamFd — returns OK on EAGAIN with need
unmet: EnsureIdle/EnsureData report success with a false postcondition.ABC-014: store
trailer/cap validation. NOTE worktree is behind 1: the tracked
///jab/dog/abc/ ref advanced (sibling ABC posts share the store).