Store-format batch (2026-07-07 review). A crafted PACK trailer drives pointer construction via a wrapping u64; PACKClose leaks everything on an ENOSPC; the SLOG writer can emit skip records its own reader cannot expand; NESTFeed keeps copying after its mark log has eaten the room it checked.
PACK.c:189-216 PACKOpen — p->datalen = trailer[0] (untrusted);
datalen near u64max wraps (datalen + PAGESIZE - 1) → tiny npages passes the idxsize == PACKIdxSize(npages) check with a matching crafted idxsize; then buf[2] = buf[0] + datalen is a wild DATA terminator — consumers read far OOB. Bound datalen against file size.
PACK.c:120-144 PACKClose — call(PACKFlush), call(PACKWritePage),
two test(w == ...) all early-return before cleanup: ENOSPC at close leaks fd + PAGE mapping + index mmap. PACKAbort exists; Close doesn't use the wrapper+worker pattern (abc.mkd §Resource lifecycle).
SLOG.c:22-27 vs SLOG.c:117 — writer clamps the flush count to 64
only when stack len ≥ 128, so 65..127-offset 'k' records are emittable; reader expands into a_pad(u64, tmp, 64) → NOROOM on an intact log. Writer cap and reader pad must agree.
SLOG.c:214-218 SLOGu8sFeedSkips — reclen byte stored without a roomcheck: if ZINTu8sFeedBlocked fills the 1024 pad EXACTLY, the store is a 1-byte OOB stack write and fullbody1 points past the pad. Overfill by ≥1 fails safely; only exact fill is unsafe.
SLOG.h:88 vs SLOG.c:186 — decl says u8gp data, def says `u8sp
into; compiles only because both erase to u8**. SLOG.md still documents 'i'/SLOG_I and a $cmpfn seek; code has 'c'/SLOG_C + u8zs`.
NEST.c:96-115 NESTFeed — one up-front $len(idle) < $len(insert)
check, then per-char unchecked copies while NESTaddvar shrinks idle1 by 16 per variable (same cell as log0): literals + 16*nvars over IDLE smashes stored mark128s; corrupted marks then drive NESTRenderTree's a_part whose bound check is assert-only (NDEBUG → wild-length OOB read). Once crossed, $size(idle) underflows and the 16-byte guard stops guarding.
NEST.h:16 — NESTInsert declared, defined nowhere (INDEX.md:374
advertises it): link error for any caller. NEST.c:26 mark128 stores are 16-byte-strided down from an unaligned buffer end — misaligned u64 stores, UBSan/strict-alignment trap.
PAGE.c:235/253 PAGEStreamFd — returns OK on EAGAIN with needunmet: EnsureIdle/EnsureData report success with a false postcondition.
SLOG seek, exact-fill FeedSkips, NESTFeed template sized to overrun.
the reclen store; re-check room in the NESTFeed loop (or precompute literal+mark cost); define or delete NESTInsert.
valid files; only writer caps and validation change.
ABC-013 sweep)