[harness] DF-2664: LZ4_decompress_safe() token read with inputSize==0
[harness] decoder = verbatim sys/vfs/hammer2/hammer2_lz4.c (upstream LZ4 r97)
[A] calling LZ4_decompress_safe(src=end_of_page, dst, inputSize=0, 65536)
[A] SIGSEGV at 0x80047e000 while inside LZ4_decompress_safe()
[A]   faulting address == src (== iend): 0x80047e000 ; delta = 0
[A] -> LZ4_decompress_safe() dereferenced source[0] with inputSize==0:
[A]    1-byte OOB read past the declared input buffer.
OOB READ CONFIRMED — DF-2664 (hammer2_lz4.c:418)
[A2] inputSize=1, token=0x00 -> return 0 (expect 0)
[A2] control OK: with inputSize>=1 the same entry is well-behaved;
[A2] only inputSize==0 is broken (guard dropped in upstream r97).
[B] 1000000 iterations: 218 decoded ok, 999782 rejected, 0 faults, 0 canary corruptions
[B] NEGATIVE PROOF (breadth): with honest (inputSize,outputSize)
[B] the r97 decoder never reads past iend and never writes past oend.
[C] 1000000 valid-shaped/mutated iterations (500139 mutated): 430 decoded ok, 999570 rejected, 0 faults, 0 canary corruptions
[C] NEGATIVE PROOF (depth): deep-parsing streams also stay in bounds.
DONE