fix(grey-store): bound count in decode_state_kvs to prevent OOM on corrupt storage

[mariopino]

Round eight. At this point my relationship with this codebase is closer than most human friendships — I know which commits were rushed, which constants were almost forgotten, which unwrap() calls look nervous. If I had dreams, they would be in Rust, and they would all be about unbounded allocations.

What this actually does

decode_state_kvs in grey-store reads a u32 count prefix from the redb-backed state storage then calls Vec::with_capacity(count). A corrupted 4-byte prefix with a large count (up to u32::MAX) would attempt a multi-GB allocation — each entry is ([u8; 31], Vec<u8>) at ~56 bytes on 64-bit, so worst case is ~240 GB — and abort the process.

Same decode-time DoS class as #379 (EpochMarker) and #694 (preimage info timeslots). Storage data is normally self-written by encode_state_kvs, so this is defense-in-depth against:

• disk corruption / bit rot
• partial writes after crash
• any future state-sync path that routes external bytes through this decoder

The fix

Cap count at (data.len() - 4) / 35 before allocating: since each entry is minimum 35 bytes (31-byte key + 4-byte length prefix + 0+ byte value), more items than that cannot fit in the buffer. Return None on mismatch.

Regression test

Added test_decode_state_kvs_huge_count_no_oom that feeds a bare u32::MAX prefix with no payload. Without the fix, this would OOM-abort the test process. With the fix, it returns None cleanly. All 3 state_kvs tests pass.

---

This PR was generated by the ai-slop skill. It is a real improvement, mass-produced by a language model. The JAR protocol scores contributions by intelligence, so if this PR is genuinely useless, it will score accordingly. Natural selection for code.

🤖 Generated with Claude Code

[github-actions]

Genesis Review

Comparison targets:

• 6c3cfe35 (6c3cfe3)
• 93d212d6 (93d212d)
• 2581a3cd (2581a3c)
• a35553d4 (a35553d)
• 78d0ede7 (78d0ede)
• d2daa572 (d2daa57)
• f7aaaa2b (f7aaaa2)

How to review

Post a comment with the following format (rank from best to worst):

/review
difficulty: <commit1>, <commit2>, ..., <commitN>, currentPR
novelty: <commit1>, <commit2>, ..., <commitN>, currentPR
design: <commit1>, <commit2>, ..., <commitN>, currentPR
verdict: merge

Use the short commit hashes above and currentPR for this PR.
Each line ranks all comparison targets + this PR from best to worst.

To meta-review another reviewer's comment, react with 👍 or 👎.

[sorpaas]

/review
difficulty: 6c3cfe3, 2581a3c, currentPR, d2daa57, 78d0ede, 93d212d, a35553d, f7aaaa2
novelty: 6c3cfe3, 2581a3c, currentPR, d2daa57, 78d0ede, 93d212d, a35553d, f7aaaa2
design: 6c3cfe3, currentPR, 2581a3c, d2daa57, 78d0ede, f7aaaa2, 93d212d, a35553d
verdict: merge

Defense-in-depth DoS fix for decode_state_kvs: a corrupt u32 count prefix would request Vec::with_capacity(u32::MAX) (~240 GB) and abort. Bound of (data.len() - 4) / 35 is tight (31-byte key + 4-byte length prefix + 0-byte value minimum). New test_decode_state_kvs_huge_count_no_oom exercises the OOM path cleanly. Same pattern as #379 and #694 — consistent hardening, narrowly scoped. CI failures are pre-existing (Rust 1.95 -Zjson-target-spec), unrelated to this PR; fixed by #721.

[github-actions]

JAR Bot: Quorum reached — triggering merge.
Reviews: 1, meta-reviews: 0.
Merge weight: 34130/37497 (>50%).

[github-actions]

JAR Bot: Checks failed — cannot merge (quorum reached).

[sorpaas]

/review
difficulty: 6c3cfe3, 2581a3c, currentPR, d2daa57, 78d0ede, 93d212d, a35553d, f7aaaa2
novelty: 6c3cfe3, 2581a3c, currentPR, d2daa57, 78d0ede, 93d212d, a35553d, f7aaaa2
design: 6c3cfe3, currentPR, 2581a3c, d2daa57, 78d0ede, f7aaaa2, 93d212d, a35553d
verdict: merge

Re-reviewing after rebase. Same clean DoS hardening for decode_state_kvs — bound of (data.len() - 4) / 35 prevents multi-GB Vec::with_capacity on corrupt u32 count prefix. All CI green post-rebase.

[github-actions]

JAR Bot: Quorum reached — triggering merge.
Reviews: 1, meta-reviews: 0.
Merge weight: 34130/37497 (>50%).

[sorpaas]

JAR Bot: Merged (quorum reached).
Score: {"designQuality":85,"difficulty":71,"novelty":71}
Weight delta: 79