DOG-011: HUNK BASS arena-lifetime + region-cap defects

Now: OPEN
Sev: HIGH

dog/HUNK.c violates the codebase's own call()-rewinds-BASS rule. HUNKu8sRelay invokes call(hunk_rebase_body, &hk, prefix) (HUNK.c:386), but hunk_rebase_body carves nt(8 MiB)/nk(1 MiB) on BASS and points hk->text/hk->toks into them — and call() UNCONDITIONALLY rewinds the BASS data+idle heads on return (abc/PRO.h:75-90), so those slices dangle the instant line 386 returns. The next call(HUNKu8sFeedOut, into, &hk) (:388) hands the dangling slices to renderers whose own carves land on the same bytes: Color mode bro_walk_hunk carves ~192 KB over the rebased text (:769) → garbage output. Plain/HTML/TLV survive only by not carving before reading — one refactor from breaking. The in-function comment "caller's call() frame owns them" (:293-296) is wrong; hunk_drain_toks is deliberately called DIRECTLY at :216 for exactly this reason. Method: Issues.

Input

Context

Use-after-rewind: HUNK.c:386 (call) → slices from :297-366 used at :388.
Unified-diff region cap silently drops data: hunk_flush_region take-loops stop at HK_REGION_MAX=4096 (:1139,1219-1228), but old_count/new_count already counted the dropped lines → @@ -l,c +l,c @@ header (:1484-1505) is internally inconsistent; git apply/patch rejects or misapplies.
Non-reentrant statics: static u8cs dl[4096], al[4096]; static i32 pair_* (~~200 KB, :1219,1230-1231); greedy pairing :1238-1257 is O(nd·na) →~~ 4096² comparisons on adversarial input (CPU DoS).
Table render headroom too small: HUNK.c:1779 carves TEXT_CAP+64KiB but Color/Html emit ~10-25 B markup per token (tok cap 256 K) → SNOROOM, hunk silently skipped (:1781), error only at HUNKTableClose (routinely ignored).
Table double-open: HUNKTableOpen (:1815-1831) has no open-guard → leaks the prior 4 MiB u8bMap+toks and discards buffered rows.
HUNKu8sDrain toks lifetime underdocumented: header says "zero-copy into original data" (HUNK.h:105-107) but hk->toks points into BASS scratch (:150-171,211-217) that dies at the caller's next call() — shorter than uri/text; a caller stashing a drained hunk gets dangling toks.
No forward-progress guard: bro_row_end_pass/hunk_color_emit (:860-874) loop forever if a caller passes cols==0.

Goals

Relay renders from LIVE memory: call hunk_rebase_body directly (propagate __ by hand) with an explicit u8aMark/u8aRewind per hunk so 9 MiB/hunk does not accumulate across a stream.
A produced unified diff is always internally consistent: fail (or chunk) when a region exceeds the cap instead of dropping lines; move dl/al to BASS.
Table render headroom sized by tok count (or incremental); double-open fails loudly; HUNKu8sDrain toks lifetime documented in the header.

Constraints

dog/ libdog, ABC style; renderer output byte-identical for in-cap inputs.

WIP

TODOs

T1 repro: a relayed Color diff hunk asserting correct output (currently garbage); a >4096-line region asserting a consistent-or-failing patch.
T2 fix the relay lifetime (direct call + mark/rewind).
T3 region-cap: fail/chunk + BASS-back the pairing arrays.
T4 table headroom + double-open guard; document HUNKu8sDrain toks lifetime.
T5 cols==0 forward-progress guard.

Blockers and bummers

HUNK.c is 1932 lines mixing wire codec + four renderers + diff post-processor + global-state table engine; a structural split would help but is out of scope here (note for a future DOG umbrella).
Audit 2026-07-07: re-verified in libdog HEAD 79612854 — call(hunk_rebase_body, ...) still at HUNK.c:386, HK_REGION_MAX=4096 statics dl/al/pair_* still at :1219-1231. NOTHING landed; WIP fix UNLANDED in worktree ~/src/DOG-011 (HUNK.c modified).

Outcome

OPEN — filed 2026-07-06, the libdog code-quality review session.