diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1934bc..ef4bd2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -205,11 +205,11 @@
     printed with its address; exit 1 when there are any. libhdf5's h5check
     reads only the 1.8 format. On the conformance corpus it passes all 418
     files that both clawhdf5 and h5py read in full, and `check --data` flags
-    152 of the 180 files of the CVE corpus (tank, 2026-09-26). `--data` also
-    follows variable-length data into its global heap collections and
-    reports a damaged one at its address. It inherits the library's
-    tolerance, though: 21 of the 28 it passes are files
-    h5dump 1.14.6 rejects (see `docs/known-issues.md`, header checks).
+    134 of the 150 CVE and fuzzer files of the `cve_hdf5` corpus (tank,
+    2026-09-26). `--data` also follows variable-length data into its global
+    heap collections and reports a damaged one at its address. It inherits
+    the library's tolerance, though: 9 of the 16 it passes are files h5dump
+    1.14.6 rejects (see `docs/known-issues.md`, header checks).
   - Values over `--max-bytes` (default 1 GiB) are reported instead of read;
     a panic is caught and reported as an internal error (exit 3).
     `scripts/h5rs-fuzz.sh` runs every subcommand over a corpus (default the
diff --git a/crates/clawhdf5-tools/README.md b/crates/clawhdf5-tools/README.md
index 2c1dab5..79f775d 100644
--- a/crates/clawhdf5-tools/README.md
+++ b/crates/clawhdf5-tools/README.md
@@ -250,9 +250,11 @@ What it does not check: free-space manager and shared-message (SOHM) table
 checksums, global heap collections no variable-length value points into (and
 none at all without `--data`), and objects reachable only by external links. It validates with
 clawhdf5's parsers, so it accepts what they accept: some header damage that
-libhdf5 refuses goes unreported (of the 180 files of the HDF Group's CVE
-corpus, `check --data` passes 28, and h5dump 1.14.6 rejects 21 of those;
-tank, 2026-09-26).
+libhdf5 refuses goes unreported. Of the 150 CVE and fuzzer files of the
+HDF Group's `cve_hdf5` corpus (`cvefiles/` and `fuzzerfiles/`),
+`check --data` passes 16, and h5dump 1.14.6 rejects 9 of those (tank,
+2026-09-26, `h5rs check --data F` and `h5dump F` per file; before the
+library's header checks it passed 28, of which h5dump rejects 21).
 
 ## Robustness
 
diff --git a/docs/known-issues.md b/docs/known-issues.md
index 9a2ae44..f2351a0 100644
--- a/docs/known-issues.md
+++ b/docs/known-issues.md
@@ -186,7 +186,9 @@ fill-value item that did is fixed).
   - (`cve-2024-32616` `/group1/dset3` and `cve-2025-2309`'s `Comp_OBJREF`
     attribute are h5py/numpy type-mapping failures, not libhdf5 refusals.)
   - `h5rs check` validates with the library's parsers, so it inherits what
-    they accept: H5RS_CHECK_CVE_COUNTS.
+    they accept: of the 150 CVE and fuzzer files, `check --data` passes 16,
+    and h5dump 1.14.6 rejects 9 of those (tank, 2026-09-26; 28 and 21
+    before these checks).
 - **Writer:**
   - Nested groups beyond one level: path-like names are now refused, not
     created.