# Rust SBE frame descriptor bounds — 2026-10-14 ## Reproduced failure and correction `FrameRead::message` is a public optional byte-view accessor. A caller can construct a `FrameRead::Frame` directly, including a range whose `start + len` cannot be represented by `usize`. The old helper evaluated that unchecked sum before calling the slice's optional bounds accessor, so overflow-checked builds panicked instead of declining the range. Valid descriptors produced by `try_extract_frame` already have bounded ranges; this is a caller-supplied public-descriptor edge, not a new wire-parser failure. The helper now computes the end with `checked_add` and returns `None` when it cannot be represented, then uses the existing optional slice bounds check. Its signature and borrowed-view behavior remain the same. Existing zero-length ranges, non-frame descriptors and ordinary out-of-buffer refusal are preserved. Framing, generated codec layout and validation policy are unchanged. ## Source pins and identical regression - Baseline engine: `fd755dbfd6b160bedfb651d52c55a92fffda4837` plus the identical new, initially untracked fixture. - First candidate: `fa903d16a5916eeb97701fcf576d5adbe9041d7c`. - Combined candidate: `2399e474ba4da7061c1439aab928dde4da1dc669`, after upstream SBE compiler, generated-code and body-version fixtures land. - `fixture-sha256.txt` identifies the exact test bytes used in both editions on baseline and candidate; the original helper is retained separately. The unchanged baseline reports **two passes, one failure, zero ignored** in both default and open editions. The failing case catches and inspects four extreme ranges, all of which unwind with `attempt to add with overflow`. The controls cover a real encoded/extracted frame at a nonzero offset, a shorter supplied buffer, both non-frame descriptors, out-of-buffer ranges and an existing valid zero-length range. This is an observed behavior failure, not a compile failure. The old optimized build may already return `None` after wrapping; this record does not claim that every build configuration panicked. ## Complete Rust qualification The first candidate passes the three new regression cases and 28 related SBE unit tests in each edition. Actual selected Rust conformance stages pass **2,432 default / 2,234 open** tests, with one existing ignored builders doctest each and zero failed or skipped stages. Strict offline all-target Clippy with `-D warnings` passes both. The before/after manifests match all 385 Rust and 632 shared input paths and hashes. Upstream `7af31ab68` changes generated SBE buffer bounds, cursors and body versions, so the complete qualification is repeated on the combined pin. Both editions again pass the three regression cases; related SBE tests now pass **30 each**. The actual selected stages pass **2,434 default / 2,236 open**, one existing ignored doctest each, zero failed and zero skipped. Strict all-target Clippy passes both. All **385 Rust / 637 shared** input paths and hashes match before and after the combined run. The retained command records show the real Cargo processes exit zero. The wrapper's exit 2 / PARTIAL denotes selecting one of 362 conformance stages per run; it is not a failure and is not a complete monorepo pass. Rust tests use the installed Cargo/rustc 1.92.0; Clippy uses the retained 1.93.1 toolchain. Builds run offline with `-j2`, test/dev debug output disabled and one test thread. Cold inventory verification, its 13 tests, coverage verification, the new fixture's rustfmt check, both changed public-source scans (zero findings) and `git diff --check` pass. One attempted combined preparation used a candidate SHA before the owned branch had been pushed. Its rebase failed; subsequent source verification correctly refused a mismatched checkout before any tests ran. This is retained only as preparation diagnostics, not as qualification or the baseline behavior reproduction. The corrected preparation checks the expected clean source pin, aborts on errors, and then performs the complete combined qualification above. The first publication rebase integrates unrelated bench evidence and Java/.NET test-fixture cleanup; all qualified inputs match exactly then. The later FIXP directory-durability merge changes only `engine/rust/src/fixp/finalized_sessions.rs` among those inputs, with all 637 shared inputs unchanged. Its owner's retained four-language fault probes and surrounding suites qualify that correction separately. At publication-integration pin `74b8446a1386d6ff08d108906e8b4ea8c1953d2d`, this session rebuilds both editions and repeats the descriptor fixture (**3/3 each**), metadata append ownership (**8/8 each**) and finalization library filter (**32 default / 23 open**). Every selection has zero failures or ignored tests. Before/after proofs match the integrated 385 Rust / 637 shared inputs. These selections overlap and are not summed as unique tests. The complete-suite and strict-Clippy totals above belong to the explicit combined pin `2399e474`; they are not relabelled as runs at this later pin. A final reviewed merge of `02428989f` changes only Rust's `sbe/udp.rs` and `sys.rs` from that integrated input set. Both files match the transport owner's qualified bytes exactly; that owner's original and integrated selections pass 32 SBE tests in each edition, zero failed/skipped/ignored ([transport record](RECORD_2026-10-14_sbe-transport-review.md)). The remaining 383 Rust files, including the descriptor helper, new regression and FIXP finalization, and all 637 shared files remain byte-identical to this session's integration run. Publication checks this precise delta, preflight, the API inventory and fixture formatting again. No full-suite or Clippy run is claimed at the final publication pin. ## Resource controls and retained evidence HP was initially queued behind other sessions. Only this session's waiting request was dequeued when Scan recovered disk space. BEELINK2's active builds were left alone and this session starts no heavy job there. Scan initially had about 600 MB available on `/home`; no build started until that rose to 22 GB. All Scan qualification uses an exclusive `isol-no-shared` CPU lease, serial `-j2` builds, one test thread, a 64 GiB start / 32 GiB stop RAM guard and a 2 GiB start / 1 GiB stop disk guard. Outputs remain under the owned `/home/yann/build/codex-fixp-ha/libhft` root. The packet at `~/archive/libhft/rust-sbe-descriptor-bounds-20261014` retains actual baseline/focus/full/lint commands and outputs, stage reports, source and input hashes, the exact fixture and a source bundle. Copies are checksum and bundle-verified on BEELINK2, HP and Scan before task scratch is removed. The cancelled HP queue is not qualification evidence. The earlier C++ CORE header registration notice is resolved by its owner in `7af31ab68`; final preflight confirms the CORE list matches its tags. ## Parity status Scores remain 82/82 applicable APIs, 27/27 protocol rows and 43 complete, two partial and one not applicable subsystem. This bounded-view correction provides no live venue/FIXP endpoint or certification evidence. The authorised pilot configuration and venue test plan requested earlier remain outstanding.