Before-buffer OOB read and conditional OOB write on CTRL(n) down-arrow at end of history

Summary

Pressing down-arrow when history cursor already at/past newest entry takes else branch clearing first byte of input buffer to NUL then falls through to hist_redraw. index() returns db_lbuf_start itself then db_le[-1] dereference reads one byte before buffer. If that byte happens to be \r or \n *--db_le=\0 writes NUL one byte before buffer 1-byte OOB write. CTRL(n) handler at :232 tests if(db_lhistcur<db_lhistidx-1) on first down-arrow always false takes else at :236-243 executes *db_lbuf_start=\0. No break falls through hist_redraw :245. index(:249) returns db_lbuf_start itself. :250 evaluates db_le[-1] which is db_lbuf_start[-1] OOB read before caller buffer. If byte==\r||\n :251 *--db_le=\0 stores NUL at db_lbuf_start[-1] 1-byte OOB write. Code lacks db_le>db_lbuf_start lower-bound check. Reachable with single keypress no history needed. DDB-only privileged context defense-in-depth. [VERIFIED pass2: value-attributed before-buffer read - pre-byte 0x0a ends 0x0d vs 0x58 unchanged tracking the OOB byte; lower-bound guard fix-validated]