After writing, FILEFlush calls u8bFed(buf, r) — which advances the DATA→IDLE boundary (grows DATA into uninitialized IDLE) instead of consuming the written prefix; the PAST→DATA boundary is never advanced, so DATA is never actually consumed and on the next flush the buffer re-writes the already-flushed bytes plus r bytes of never-initialized memory to the file. The goal is to consume the written prefix and handle r==0.
Wrong boundary advanced after write().
abc/FILE.c:508-519 — u8bFed(buf,r) (= u8sFed(u8bIdle(buf),r)) extends DATA; buf[1] (PAST→DATA) never moves, so u8bShift(buf,0) at :515 never fires and DATA only grows.u8sFed's internal guard keeps it inside the allocation (no pointer-past-end write), so it is contained but real.None.
Consume, don't extend.
FILE_WANT_BUFS stream past PAGESIZE, flush twice, assert the file equals the fed bytes (no duplication/garbage).u8bFed(buf,r) with u8bUsed(buf,(size_t)r) (advance buf[1]), keep the u8bShift compaction, and guard r==0 (avoid an infinite no-op flush).