Compress path heap buffer overflow via incorrect worst-case expansion bound

Summary

Input size check at :397 uses PRED1_BUF_SIZE*8/9+1+4=3645 but mathematically correct maximum guaranteeing worst-case compressed output fits in outbuf+2(4094 bytes) is 3639. For inlen=3645 with all-wrong dictionary guesses on freshly-initialized node Pred1Compress writes 4101 bytes to outbuf+2 overflowing 7 bytes past 4096-byte outbuf boundary. Overflow lands in struct padding between outbuf and stats field on x86-64 no observable effect. Overflow path write-only compressed output never sent on wire (uncompressed branch taken when len>=inlen). Off by 6 in formula producing 6 extra input bytes each adding ~1.125 output bytes = ~7 bytes overflow. [VERIFIED pass2: reproduced padding-exact - adversarial all-wrong-guess input at inlen 3645 writes exactly 7 compressed bytes landing entirely in struct padding as the finding predicted, stats intact]