The AI scan (crates/ai) needs to read OpenCode's settings, and ai can't depend on setup (same layer). The parser has no I/O and no workspace dependencies, so it moves to formats unchanged; setup uses it from there.
A .utoc header naming billions of zero-length compression methods no longer collects empty names until memory runs out: only the 255 a block can point at are read, the rest are skipped by length.
va_to_off added a PT_LOAD segment's file offset to an address delta unchecked, so a segment whose p_offset is near u64::MAX panicked in debug builds and wrapped in release. It now uses checked_add, so such an address maps to nothing. Two regression tests, one with a crafted ELF64.
A group descriptor could point the inode table so far out that an inode started within 128 bytes of usize::MAX; the two checks that an inode fits in the image added 128 unchecked, which panicked in debug builds and wrapped in release. They now use checked_add, so such a root inode is refused and such a child skipped. Two regression tests, and a roadmap line for the same pattern in macho.rs method_list.
A native, pure-Rust app that shows anyone how a piece of software works, with
evidence-backed answers, then helps them rebuild it. It ships a desktop app, a
CLI and an MCP server, all driven by one engine.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bflatastic