docs: h5rs check CVE counts measured with the header checks merged

Measured on tank on the 150 cvefiles/ and fuzzerfiles/ of cve_hdf5 (the
earlier text said 180): check --data passes 16 (was 28), and h5dump
1.14.6 rejects 9 of those (was 21). It still flags none of the 418
conformance files both readers read in full.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

CHANGELOG.md

@@ -205,11 +205,11 @@
     printed with its address; exit 1 when there are any. libhdf5's h5check
     reads only the 1.8 format. On the conformance corpus it passes all 418
     files that both clawhdf5 and h5py read in full, and `check --data` flags
-    152 of the 180 files of the CVE corpus (tank, 2026-09-26). `--data` also
+    134 of the 150 CVE and fuzzer files of the `cve_hdf5` corpus (tank,
-    follows variable-length data into its global heap collections and
+    2026-09-26). `--data` also follows variable-length data into its global
-    reports a damaged one at its address. It inherits the library's
+    heap collections and reports a damaged one at its address. It inherits
-    tolerance, though: 21 of the 28 it passes are files
+    the library's tolerance, though: 9 of the 16 it passes are files h5dump
-    h5dump 1.14.6 rejects (see `docs/known-issues.md`, header checks).
+    1.14.6 rejects (see `docs/known-issues.md`, header checks).
   - Values over `--max-bytes` (default 1 GiB) are reported instead of read;
     a panic is caught and reported as an internal error (exit 3).
     `scripts/h5rs-fuzz.sh` runs every subcommand over a corpus (default the

crates/clawhdf5-tools/README.md

@@ -250,9 +250,11 @@ What it does not check: free-space manager and shared-message (SOHM) table
 checksums, global heap collections no variable-length value points into (and
 none at all without `--data`), and objects reachable only by external links. It validates with
 clawhdf5's parsers, so it accepts what they accept: some header damage that
-libhdf5 refuses goes unreported (of the 180 files of the HDF Group's CVE
+libhdf5 refuses goes unreported. Of the 150 CVE and fuzzer files of the
-corpus, `check --data` passes 28, and h5dump 1.14.6 rejects 21 of those;
+HDF Group's `cve_hdf5` corpus (`cvefiles/` and `fuzzerfiles/`),
-tank, 2026-09-26).
+`check --data` passes 16, and h5dump 1.14.6 rejects 9 of those (tank,
+2026-09-26, `h5rs check --data F` and `h5dump F` per file; before the
+library's header checks it passed 28, of which h5dump rejects 21).
 
 ## Robustness
 

docs/known-issues.md

@@ -186,7 +186,9 @@ fill-value item that did is fixed).
   - (`cve-2024-32616` `/group1/dset3` and `cve-2025-2309`'s `Comp_OBJREF`
     attribute are h5py/numpy type-mapping failures, not libhdf5 refusals.)
   - `h5rs check` validates with the library's parsers, so it inherits what
-    they accept: H5RS_CHECK_CVE_COUNTS.
+    they accept: of the 150 CVE and fuzzer files, `check --data` passes 16,
+    and h5dump 1.14.6 rejects 9 of those (tank, 2026-09-26; 28 and 21
+    before these checks).
 - **Writer:**
   - Nested groups beyond one level: path-like names are now refused, not
     created.