drsuapi: fix V6 parser drift on child-domain UPTODATE_VECTOR

[psycep]

Summary

Fixes #28: secretsdump DCSync silently returning zero accounts against child domains. Root cause is a missing Align(8) in skipUpToDateVectorV2. UPTODATE_VECTOR_V{1,2}_EXT cursors contain LONGLONG (USN, DSTIME), giving the struct 8-byte alignment. NDR hoists the array's MaxCount to the front using its primitive 4-byte alignment; the struct's 8-byte alignment then applies AFTER MaxCount before the first field. This is the exact same correctness pattern PR #16 (8127aec) enumerated for PROPERTY_META_DATA_EXT_VECTOR, just missed for UPTODATE_VECTOR.

PR #16's verification ran against sevenkingdoms.local (forest root), where the response's DSNAME ends at pos 260, so post-MaxCount lands at 264 (already 8-aligned). Align(8) was a no-op and the miss was invisible. north.sevenkingdoms.local's longer DN puts post-MaxCount at 284 (%8 == 4); the missing pad drops 4 bytes, the parser misreads cNumCursors as 0, skips zero cursor bytes instead of the real 32-byte cursor, and walks into garbage in the prefix-table deferred data. Zero accounts come back, no error surfaces (V6 parse errors are swallowed unless -debug is on).

Verified against the live GOAD lab:

• north.sevenkingdoms.local: 18/18 NTDS hashes match impacket-secretsdump byte-for-byte (was 0 before the fix).
• sevenkingdoms.local: 17/17 still match PR drsuapi: fix DsGetNCChanges V6 parser to actually extract NTDS hashes #16's original verification.

Hardening sweep

While in the parser, fixed a set of related correctness and DoS-hardening issues surfaced by a focused audit:

• MaxCount wire authority. skipUpToDateVectorV2 and readPrefixTableV2 now drive their loops from the wire MaxCount (the authoritative NDR field) rather than the sibling in-struct cNumCursors / cNumPrefixes. They agree on well-formed replies; on malformed ones, trusting the wire keeps the cursor aligned.

• Linked-list early termination. readREPLENTINFLISTArrayV2 now breaks on pNextEntInf == 0. REPLENTINFLIST is structurally a linked list per MS-DRSR; the chain terminator is the structural truth, not cNumObjects.

• Pointer-only deferred gating. Three call sites previously gated deferred reads on pointer != 0 && count > 0. NDR serializes a 4-byte MaxCount==0 even for a non-null pointer to an empty array; the old gating dropped that read and drifted. Gate solely on the pointer.

• Decoder.Fail() helper. New method that sets d.err only on first failure, so descriptive failure context survives downstream Skip/Align calls. Every maxReasonable bail-out now uses it. Previously the silent return left the cursor unadvanced and the next helper read into the wrong data.

• SeekTo first-error-wins. SeekTo (and by extension Skip and Align) now short-circuit when d.err is already set, so a generic seek-range error in a later Skip doesn't clobber a more descriptive Fail() error.

• 32-bit overflow caps. DSNAME and PROPERTY_META_DATA_EXT_VECTOR helpers now apply the maxReasonable cap on count * size products that could wrap int on 32-bit Go builds. The cap is promoted to a package-level constant so all helpers share it.

• SID minimum length. RID extraction in readDSNAMEv2 and processAttribute (ATTID_objectSid) now requires sidLen >= 12 (rev + subAuthCount + idAuth + at least one SubAuthority). At length 8 the "last 4 bytes" is the tail of IdentifierAuthority, which would have produced bogus DES keys for password decryption on a malformed SID.

• DN parsing. Case-insensitive CN= prefix check and backslash-aware RDN split, so an account with an escaped comma in its CN (e.g. CN=Smith\, John,OU=...) extracts the right SAMAccountName.

Test plan

• secretsdump -k -no-pass -just-dc against winterfell.north.sevenkingdoms.local returns 18 NTDS hashes matching impacket byte-for-byte (was 0).
• secretsdump -k -no-pass -just-dc against kingslanding.sevenkingdoms.local still returns the original PR drsuapi: fix DsGetNCChanges V6 parser to actually extract NTDS hashes #16 baseline 17 hashes.
• go build ./... clean.
• go vet ./... clean.