[harness] DF-2664: LZ4_decompress_safe() token read with inputSize==0
[harness] decoder = verbatim sys/vfs/hammer2/hammer2_lz4.c (upstream LZ4 r97)
[A] calling LZ4_decompress_safe(src=end_of_page, dst, inputSize=0, 65536)
[A] returned -1 WITHOUT faulting
FIX VALIDATED - inputSize==0 cleanly rejected, no OOB read
[A2] inputSize=1, token=0x00 -> return 0 (expect 0)
[A2] control OK: with inputSize>=1 the same entry is well-behaved;
[A2] only inputSize==0 is broken (guard dropped in upstream r97).
[B] 1000000 iterations: 218 decoded ok, 999782 rejected, 0 faults, 0 canary corruptions
[B] NEGATIVE PROOF (breadth): with honest (inputSize,outputSize)
[B] the r97 decoder never reads past iend and never writes past oend.
[C] 1000000 valid-shaped/mutated iterations (500139 mutated): 430 decoded ok, 999570 rejected, 0 faults, 0 canary corruptions
[C] NEGATIVE PROOF (depth): deep-parsing streams also stay in bounds.
DONE