Residue of the 2026-07-24 jab/dog/git/ review: real but small defects that don't warrant one ticket each. Each TODO is self-contained; fix repro-first where a behavior changes, comment-only items need none. The four big findings went to GIT-011 (extended), GIT-023, GIT-024, GIT-025. Method: work.
dog/git/{GIT,PACK,DELT,ZINF,PKT,PIDX,CFG,IGNO,SUBS,SHA1}..gitmodules blobs arrive off the wire.GIT.c:163 git_drain_decimal: no overflow guard — a long digit run in a commit ident is signed i64 overflow (UB); clamp digits.SHA1.h:17 sha1empty reads data[20] via u64c*/u32c* — unaligned + strict-aliasing UB; byte-OR loop or memcmp vs zeros.CFG.c.rl: grammar requires a trailing \n — a config blob ending mid-line (git-legal) yields CFGBAD; SUBS then fails the WHOLE .gitmodules and drops the last submodule. Accept EOF as EOL.CFG.c.rl q_esc admits only \n \t \b \" \\ — git accepts ANY backslash-escape in quoted strings; one \, fails the parse.GIT.c:348 GITFeedRef: u8bFeed returns unchecked → silent ref truncation on a short buffer; call() them (abc.mkd feed rule).DELT.c:29 DELTApply never checks declared base_sz against the actual $size(base) — a wrong base applies to plausible garbage instead of DELTBADFMT (git verifies this).IGNO.c: glob lacks char classes [a-z] and backslash escapes — such patterns silently never match; document or implement.IGNO.c ** matching is exponential-backtracking worst case; IGNO_MAX_PATTERNS/IGNO_MAX_CHAIN overflow drops rules silently (log or error, no silent cap).PKT.c:32 response-end (0002) is conflated with PKTFLUSH and PKT.h doesn't say; PKT.c:36 payload_len is dead code.SHA1.h:124 sha1Drain does *from += 20 + memcpy — the banned slice→pointer mode switch; u8csUsed + typed copy.SUBS.c:124 SUBSu8bSynth: hand-built slice literals with manual length constants (use a_cstr); no escaping of "/\ in path → .gitmodules injection from a hostile mount path.PACK.c:128 PACKu8sFeedObj comment claims "never leaves a truncated record" — false on the error path (header+ofs already fed, no rollback); fix the contract text or add rollback.PACK.c:51 / DELT.c:8 varint decoders silently drop bits at shift ≥ ~58; add a range test so sizes can't alias.PIDX.c:62 pidx_emit_at inflates each record at least twice (resolve + PACKRecordEnd) and re-resolves chains from scratch — quadratic-ish on deep-delta logs; measure, then decide.