JS-115: io._ram writes through an unchecked malloc(sizeof(size_t))

Now: DONE

Proposed by the 2026-07-07 jab multi-agent review; confirmed by both skeptic verifiers. The mmap right above is checked; the tiny length-box malloc is not — a NULL write on allocation failure.

Input

Context

JABCioRam: size_t* len = (size_t*)malloc(sizeof(size_t)); *len = n; with no NULL check (jab io.cpp:568); the n-byte mmap above IS checked against MAP_FAILED.

Goals

if (!len) { munmap(map, n); JABC_THROW(...); } before the write.

Constraints

Two-line fix; no repro test required for an OOM branch (ruling per work.mkd item 3), but the error path must free the mmap.

WIP

TODOs

null-check + munmap on the error path

2026-07-10 revision: still OPEN — io.cpp:568 malloc(sizeof(size_t)) then :569 *len=n, no NULL check; mmap above (:565-567) IS MAP_FAILED-checked