asdf-core 0.2.4, asdf-rs 0.2.1, libasdf-rs 0.2.2.

Five unchecked .product()/.sum() calls on file-controlled numbers, found by
the structured fuzz target in a function that already carried the arithmetic
lint -- which flags operators, not method calls.