A hostile chunk whose header gave a compressed size below 16 bytes, not stored raw, made the block-table check subtract past zero: a panic in any build with overflow checks (cargo test, maturin develop, debug CLI). The frame size is now checked against the header size, and the stream-length read no longer adds to an untrusted offset. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>