dog/HUNK.c violates the codebase's own call()-rewinds-BASS rule. HUNKu8sRelay invokes call(hunk_rebase_body, &hk, prefix) (HUNK.c:386), but hunk_rebase_body carves nt(8 MiB)/nk(1 MiB) on BASS and points hk->text/hk->toks into them — and call() UNCONDITIONALLY rewinds the BASS data+idle heads on return (abc/PRO.h:75-90), so those slices dangle the instant line 386 returns. The next call(HUNKu8sFeedOut, into, &hk) (:388) hands the dangling slices to renderers whose own carves land on the same bytes: Color mode bro_walk_hunk carves ~192 KB over the rebased text (:769) → garbage output. Plain/HTML/TLV survive only by not carving before reading — one refactor from breaking. The in-function comment "caller's call() frame owns them" (:293-296) is wrong; hunk_drain_toks is deliberately called DIRECTLY at :216 for exactly this reason. Method: Issues.
HUNK.c:386 (call) → slices from :297-366 used at :388.hunk_flush_region take-loops
stop at HK_REGION_MAX=4096 (:1139,1219-1228), but old_count/new_count already counted the dropped lines → @@ -l,c +l,c @@ header (:1484-1505) is internally inconsistent; git apply/patch rejects or misapplies.
static u8cs dl[4096], al[4096]; static i32 pair_*
(~200 KB, :1219,1230-1231); greedy pairing :1238-1257 is O(nd·na) → ~4096² comparisons on adversarial input (CPU DoS).
HUNK.c:1779 carves TEXT_CAP+64KiB but
Color/Html emit ~10-25 B markup per token (tok cap 256 K) → SNOROOM, hunk silently skipped (:1781), error only at HUNKTableClose (routinely ignored).
HUNKTableOpen (:1815-1831) has no open-guard → leaks
the prior 4 MiB u8bMap+toks and discards buffered rows.
HUNKu8sDrain toks lifetime underdocumented: header says "zero-copy into
original data" (HUNK.h:105-107) but hk->toks points into BASS scratch (:150-171,211-217) that dies at the caller's next call() — shorter than uri/text; a caller stashing a drained hunk gets dangling toks.
bro_row_end_pass/hunk_color_emit (:860-874)
loop forever if a caller passes cols==0.
hunk_rebase_body directly (propagate
__ by hand) with an explicit u8aMark/u8aRewind per hunk so 9 MiB/hunk does not accumulate across a stream.
region exceeds the cap instead of dropping lines; move dl/al to BASS.
loudly; HUNKu8sDrain toks lifetime documented in the header.
dog/ libdog, ABC style; renderer output byte-identical for in-cap inputs.garbage); a >4096-line region asserting a consistent-or-failing patch.
HUNKu8sDrain toks lifetime.cols==0 forward-progress guard.global-state table engine; a structural split would help but is out of scope here (note for a future DOG umbrella).
79612854 — call(hunk_rebase_body, ...) still at HUNK.c:386, HK_REGION_MAX=4096 statics dl/al/pair_* still at :1219-1231. NOTHING landed; WIP fix UNLANDED in worktree ~/src/DOG-011 (HUNK.c modified).