commit blocks come from PDSes we do not trust, and a panic in the firehose intake task takes the connection down with it. these targets exist to make sure malformed input produces an error rather than an abort.

cargo +nightly fuzz run car    fuzz/corpus/car    fuzz/seeds/car
cargo +nightly fuzz run invert fuzz/corpus/invert fuzz/seeds/invert

car — CARv1 framing against arbitrary bytes.
invert — one byte of operation count, three bytes per operation, then the CAR. operation CIDs are drawn from the CAR's own blocks, so inputs get past trivial mismatches and reach the tree itself rather than only the decoder.

seeds/ is derived from the vendored mst-test-suite CARs: car seeds are those files verbatim, invert seeds are each prefixed with four different operation specs. they are committed because they are small, deterministic, and give the fuzzer real trees to mutate from. corpus/ and artifacts/ are not.

found so far #

Cid::from_bytes_raw indexed bytes[3] with a minimum length of 3, so a three-byte CID body panicked. reachable from any DAG-CBOR a peer sends. the bug is upstream in dasl 0.2.0 and is fixed in our vendored copy, marked DIVERGES FROM UPSTREAM; it wants reporting before we un-vendor.