Post

The PE metadata implied an executable extent of 24,390,512 bytes—beyond the bytes available to this scanner invocation. The input-derived length reached sbuf_t, whose bounds check rejected the slice with a controlled exception.

This was not exploitable out-of-bounds access: reads and slices are mediated by sbuf_t. The fix preserves the recognized PE feature, skips an incomplete carve, safely hashes short buffers, and adds a real-fixture regression test.

Why Codex could move quickly: bounded position-aware data, modular scanners, structured diagnostics, separate recorders, real fixtures, and focused tests. AI didn’t replace software engineering; it amplified excellent underlying structure.