castrum 0.9.10 → 0.9.11

package/rust/ffi/hashing.rs

@@ -7,19 +7,20 @@
 use std::ptr;
 use std::slice;
 
-use super::util::panic_guard;
-
+use super::util::{c_abi, panic_guard};
 /// CRC32 over `data[0..len]`. Returns the CRC-32 checksum.
 ///
 /// # Safety
 /// `data` must be valid for reads of `len` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_crc32(data: *const u8, len: usize) -> u32 {
-    if data.is_null() && len != 0 {
-        return 0;
-    }
-    let bytes = slice::from_raw_parts(data, len);
-    crate::crypto::hashing::crc32_bytes(bytes)
+    c_abi!(0, {
+        if data.is_null() && len != 0 {
+            return 0;
+        }
+        let bytes = slice::from_raw_parts(data, len);
+        crate::crypto::hashing::crc32_bytes(bytes)
+    })
 }
 
 /// FNV-1a 64 over `data[0..len]`.
@@ -28,11 +29,13 @@ pub unsafe extern "C" fn castrum_crc32(data: *const u8, len: usize) -> u32 {
 /// `data` must be valid for reads of `len` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_fnv1a64(data: *const u8, len: usize) -> u64 {
-    if data.is_null() && len != 0 {
-        return 0;
-    }
-    let bytes = slice::from_raw_parts(data, len);
-    crate::crypto::hashing::fnv1a64_bytes(bytes)
+    c_abi!(0, {
+        if data.is_null() && len != 0 {
+            return 0;
+        }
+        let bytes = slice::from_raw_parts(data, len);
+        crate::crypto::hashing::fnv1a64_bytes(bytes)
+    })
 }
 
 /// XXH3-64 over `data[0..len]`.
@@ -41,11 +44,13 @@ pub unsafe extern "C" fn castrum_fnv1a64(data: *const u8, len: usize) -> u64 {
 /// `data` must be valid for reads of `len` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_xxh3(data: *const u8, len: usize) -> u64 {
-    if data.is_null() && len != 0 {
-        return 0;
-    }
-    let bytes = slice::from_raw_parts(data, len);
-    crate::crypto::hashing::fast_hash_bytes(bytes)
+    c_abi!(0, {
+        if data.is_null() && len != 0 {
+            return 0;
+        }
+        let bytes = slice::from_raw_parts(data, len);
+        crate::crypto::hashing::fast_hash_bytes(bytes)
+    })
 }
 
 /// JSON-validity check over `data[0..len]`. Returns 1 if the bytes are
@@ -55,11 +60,13 @@ pub unsafe extern "C" fn castrum_xxh3(data: *const u8, len: usize) -> u64 {
 /// `data` must be valid for reads of `len` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_json_valid(data: *const u8, len: usize) -> u8 {
-    if data.is_null() {
-        return 0;
-    }
-    let bytes = slice::from_raw_parts(data, len);
-    u8::from(crate::json::json_ops::json_valid_bytes(bytes))
+    c_abi!(0, {
+        if data.is_null() {
+            return 0;
+        }
+        let bytes = slice::from_raw_parts(data, len);
+        u8::from(crate::json::json_ops::json_valid_bytes(bytes))
+    })
 }
 
 /// UTF-8 validity check over `data[0..len]`. Returns 1 if the bytes are valid
@@ -70,11 +77,13 @@ pub unsafe extern "C" fn castrum_json_valid(data: *const u8, len: usize) -> u8 {
 /// `data` must be valid for reads of `len` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_utf8_valid(data: *const u8, len: usize) -> u8 {
-    if data.is_null() {
-        return 0;
-    }
-    let bytes = slice::from_raw_parts(data, len);
-    u8::from(std::str::from_utf8(bytes).is_ok())
+    c_abi!(0, {
+        if data.is_null() {
+            return 0;
+        }
+        let bytes = slice::from_raw_parts(data, len);
+        u8::from(std::str::from_utf8(bytes).is_ok())
+    })
 }
 
 /// Lowercase-hex encode `data[0..len]` into `out[0..out_cap]`. Returns bytes
@@ -90,12 +99,14 @@ pub unsafe extern "C" fn castrum_hex_encode(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if data.is_null() || out.is_null() || len.checked_mul(2).is_none_or(|n| n > out_cap) {
-        return 0;
-    }
-    let input = slice::from_raw_parts(data, len);
-    let output = slice::from_raw_parts_mut(out, len * 2);
-    crate::crypto::base64::hex_encode_into_slice(input, output).unwrap_or(0)
+    c_abi!(0, {
+        if data.is_null() || out.is_null() || len.checked_mul(2).is_none_or(|n| n > out_cap) {
+            return 0;
+        }
+        let input = slice::from_raw_parts(data, len);
+        let output = slice::from_raw_parts_mut(out, len * 2);
+        crate::crypto::base64::hex_encode_into_slice(input, output).unwrap_or(0)
+    })
 }
 
 /// RFC 3986 percent-encode `data[0..len]` into `out[0..out_cap]`. Returns
@@ -112,12 +123,14 @@ pub unsafe extern "C" fn castrum_url_encode(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if data.is_null() || out.is_null() {
-        return 0;
-    }
-    let input = slice::from_raw_parts(data, len);
-    let output = slice::from_raw_parts_mut(out, out_cap);
-    crate::http::url_codec::url_encode_into_slice(input, output).unwrap_or_default()
+    c_abi!(0, {
+        if data.is_null() || out.is_null() {
+            return 0;
+        }
+        let input = slice::from_raw_parts(data, len);
+        let output = slice::from_raw_parts_mut(out, out_cap);
+        crate::http::url_codec::url_encode_into_slice(input, output).unwrap_or_default()
+    })
 }
 
 /// Hex-decode `data[0..len]` into `out[0..out_cap]`. Returns bytes written
@@ -133,12 +146,14 @@ pub unsafe extern "C" fn castrum_hex_decode(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if data.is_null() || out.is_null() {
-        return 0;
-    }
-    let input = slice::from_raw_parts(data, len);
-    let output = slice::from_raw_parts_mut(out, out_cap);
-    crate::crypto::base64::hex_decode_into_slice(input, output).unwrap_or_default()
+    c_abi!(0, {
+        if data.is_null() || out.is_null() {
+            return 0;
+        }
+        let input = slice::from_raw_parts(data, len);
+        let output = slice::from_raw_parts_mut(out, out_cap);
+        crate::crypto::base64::hex_decode_into_slice(input, output).unwrap_or_default()
+    })
 }
 
 /// Percent-decode `data[0..len]` into `out[0..out_cap]`. Returns bytes
@@ -154,12 +169,14 @@ pub unsafe extern "C" fn castrum_url_decode(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if data.is_null() || out.is_null() {
-        return 0;
-    }
-    let input = slice::from_raw_parts(data, len);
-    let output = slice::from_raw_parts_mut(out, out_cap);
-    crate::http::url_codec::url_decode_into_slice(input, output).unwrap_or_default()
+    c_abi!(0, {
+        if data.is_null() || out.is_null() {
+            return 0;
+        }
+        let input = slice::from_raw_parts(data, len);
+        let output = slice::from_raw_parts_mut(out, out_cap);
+        crate::http::url_codec::url_decode_into_slice(input, output).unwrap_or_default()
+    })
 }
 
 /// Sum of `id` fields across a JSON array (sonic-rs zero-DOM) → packed

package/rust/ffi/http.rs

@@ -6,8 +6,7 @@
 
 use std::slice;
 
-use super::util::{cstring_return, panic_guard};
-
+use super::util::{c_abi, cstring_return, panic_guard};
 /// crc32-based ETag (10 strong / 12 weak) into `out`; `weak` is a u8 flag.
 ///
 /// # Safety
@@ -22,13 +21,15 @@ pub unsafe extern "C" fn castrum_etag(
     len: usize,
     weak: u8,
 ) -> *const std::os::raw::c_char {
-    if data.is_null() {
-        return std::ptr::null();
-    }
-    let crc = crc32fast::hash(slice::from_raw_parts(data, len));
-    let needed = if weak != 0 { 12 } else { 10 };
-    cstring_return(needed, |out| {
-        crate::http::etag::etag_from_crc32_into(crc, weak != 0, out).ok()
+    c_abi!(std::ptr::null(), {
+        if data.is_null() {
+            return std::ptr::null();
+        }
+        let crc = crc32fast::hash(slice::from_raw_parts(data, len));
+        let needed = if weak != 0 { 12 } else { 10 };
+        cstring_return(needed, |out| {
+            crate::http::etag::etag_from_crc32_into(crc, weak != 0, out).ok()
+        })
     })
 }
 
@@ -47,16 +48,22 @@ pub unsafe extern "C" fn castrum_etag_into(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if data.is_null() || out.is_null() {
-        return 0;
-    }
-    let needed = if weak != 0 { 12 } else { 10 };
-    if out_cap < needed {
-        return needed;
-    }
-    let crc = crc32fast::hash(slice::from_raw_parts(data, len));
-    crate::http::etag::etag_from_crc32_into(crc, weak != 0, slice::from_raw_parts_mut(out, needed))
+    c_abi!(0, {
+        if data.is_null() || out.is_null() {
+            return 0;
+        }
+        let needed = if weak != 0 { 12 } else { 10 };
+        if out_cap < needed {
+            return needed;
+        }
+        let crc = crc32fast::hash(slice::from_raw_parts(data, len));
+        crate::http::etag::etag_from_crc32_into(
+            crc,
+            weak != 0,
+            slice::from_raw_parts_mut(out, needed),
+        )
         .unwrap_or_default()
+    })
 }
 
 /// Evaluate `ConditionalRequest::is_not_modified` against the precompiled state
@@ -227,11 +234,13 @@ pub unsafe extern "C" fn castrum_accept_negotiator_negotiate_server(
 /// `out` must be valid for writes of up to `out_cap` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_http_date_into(secs: f64, out: *mut u8, out_cap: usize) -> usize {
-    if out.is_null() {
-        return 0;
-    }
-    let output = slice::from_raw_parts_mut(out, out_cap);
-    crate::http::http_date::http_date_into_slice(secs as i64, output).unwrap_or(0)
+    c_abi!(0, {
+        if out.is_null() {
+            return 0;
+        }
+        let output = slice::from_raw_parts_mut(out, out_cap);
+        crate::http::http_date::http_date_into_slice(secs as i64, output).unwrap_or(0)
+    })
 }
 
 /// Parse an IMF-fixdate back to unix seconds → packed `[u8 ok][i64 secs LE]`
@@ -721,7 +730,7 @@ pub unsafe extern "C" fn castrum_form_parse_packed(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    castrum_query_parse_packed(data, len, out, out_cap)
+    c_abi!(0, { castrum_query_parse_packed(data, len, out, out_cap) })
 }
 
 /// Parse a `multipart/form-data` body into the packed parts layout (the same

package/rust/ffi/ingress.rs

@@ -8,8 +8,7 @@
 
 use std::slice;
 
-use super::util::panic_guard;
-
+use super::util::{c_abi, panic_guard};
 /// Run the ingress pipeline on a packed request frame. `inner` is the opaque
 /// pointer (as an integer) from `Ingress.ingressInnerPtr()` — valid ONLY while
 /// the `Ingress` instance is alive (see the method's safety note). This is the
@@ -290,14 +289,16 @@ impl IngressLayout {
 /// `out` must be valid for writes up to `out_cap`.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_ingress_layout(out: *mut u8, out_cap: usize) -> usize {
-    if out.is_null() {
-        return 0;
-    }
-    const LAYOUT: IngressLayout = IngressLayout::from_output();
-    let n = core::mem::size_of::<IngressLayout>();
-    if out_cap < n {
-        return 0;
-    }
-    core::ptr::copy_nonoverlapping(&LAYOUT as *const IngressLayout as *const u8, out, n);
-    n
+    c_abi!(0, {
+        if out.is_null() {
+            return 0;
+        }
+        const LAYOUT: IngressLayout = IngressLayout::from_output();
+        let n = core::mem::size_of::<IngressLayout>();
+        if out_cap < n {
+            return 0;
+        }
+        core::ptr::copy_nonoverlapping(&LAYOUT as *const IngressLayout as *const u8, out, n);
+        n
+    })
 }

package/rust/ffi/metrics.rs

@@ -10,8 +10,7 @@
 
 use std::slice;
 
-use super::util::panic_guard;
-
+use super::util::{c_abi, panic_guard};
 /// `u32::MAX` — the declare-failure sentinel (fits f64 exactly; real series
 /// ids are dense from 0 and capped well below this).
 pub(crate) const METRICS_DECLARE_ERR: u32 = u32::MAX;
@@ -294,11 +293,13 @@ pub unsafe extern "C" fn castrum_metrics_render(
 /// `handle` must be either 0 or a live handle not yet destroyed.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_metrics_destroy(handle: usize) {
-    if handle != 0 {
-        drop(Box::from_raw(
-            handle as *mut crate::metrics::MetricsRegistry,
-        ));
-    }
+    c_abi!((), {
+        if handle != 0 {
+            drop(Box::from_raw(
+                handle as *mut crate::metrics::MetricsRegistry,
+            ));
+        }
+    })
 }
 
 /// Split a `\x1f`-separated key list into owned strings (empty input → []).

package/rust/ffi/payload.rs

@@ -6,8 +6,7 @@
 
 use std::slice;
 
-use super::util::{cstring_return, panic_guard};
-
+use super::util::{c_abi, cstring_return, panic_guard};
 /// RFC 6455 Sec-WebSocket-Accept (28 bytes) returned as a null-terminated C
 /// string into the per-thread reused buffer (`cstring` return).
 ///
@@ -52,19 +51,21 @@ pub unsafe extern "C" fn castrum_ws_accept_key_into(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if key.is_null() || out.is_null() {
-        return 0;
-    }
-    if out_cap < 28 {
-        return 28;
-    }
-    match crate::payload::websocket::ws_accept_key_into(
-        slice::from_raw_parts(key, klen),
-        slice::from_raw_parts_mut(out, 28),
-    ) {
-        Ok(28) => 28,
-        _ => 0,
-    }
+    c_abi!(0, {
+        if key.is_null() || out.is_null() {
+            return 0;
+        }
+        if out_cap < 28 {
+            return 28;
+        }
+        match crate::payload::websocket::ws_accept_key_into(
+            slice::from_raw_parts(key, klen),
+            slice::from_raw_parts_mut(out, 28),
+        ) {
+            Ok(28) => 28,
+            _ => 0,
+        }
+    })
 }
 
 /// WebSocket frame encode into `out` (opcode 1/2/8/9/10, `mask`/`fin` flags).
@@ -216,14 +217,16 @@ compress_to_out!(
 /// `data` must be valid for reads of `len` bytes.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_gzip_isize(data: *const u8, len: usize) -> u32 {
-    if data.is_null() || len < 18 {
-        return 0;
-    }
-    let s = slice::from_raw_parts(data, len);
-    if s[0] != 0x1f || s[1] != 0x8b {
-        return 0;
-    }
-    u32::from_le_bytes([s[len - 4], s[len - 3], s[len - 2], s[len - 1]])
+    c_abi!(0, {
+        if data.is_null() || len < 18 {
+            return 0;
+        }
+        let s = slice::from_raw_parts(data, len);
+        if s[0] != 0x1f || s[1] != 0x8b {
+            return 0;
+        }
+        u32::from_le_bytes([s[len - 4], s[len - 3], s[len - 2], s[len - 1]])
+    })
 }
 
 /// Encode one SSE event into `out`. Optional fields use `flags` bits

package/rust/ffi/probe.rs

@@ -15,15 +15,18 @@
 
 use std::slice;
 
+use super::util::c_abi;
 /// Bare C-ABI trampoline floor: does nothing, returns nothing.
 #[no_mangle]
-pub extern "C" fn ffi_probe_noop() {}
+pub extern "C" fn ffi_probe_noop() {
+    c_abi!((), {})
+}
 
 /// Scalar pass-through: returns `v` unchanged. Measures scalar-arg + return
 /// conversion only (bind with `usize` vs `u64_fast` to isolate BigInt boxing).
 #[no_mangle]
 pub extern "C" fn ffi_probe_echo_usize(v: usize) -> usize {
-    v
+    c_abi!(0, { v })
 }
 
 /// View pass-through: returns the byte length of the `(ptr, len)` pair.
@@ -34,11 +37,13 @@ pub extern "C" fn ffi_probe_echo_usize(v: usize) -> usize {
 /// form a slice whose length we return — never dereferenced).
 #[no_mangle]
 pub unsafe extern "C" fn ffi_probe_echo_view(data: *const u8, len: usize) -> usize {
-    if data.is_null() && len != 0 {
-        return 0;
-    }
-    let _ = slice::from_raw_parts(data, len);
-    len
+    c_abi!(0, {
+        if data.is_null() && len != 0 {
+            return 0;
+        }
+        let _ = slice::from_raw_parts(data, len);
+        len
+    })
 }
 
 /// `cstring`-ARG pass-through: returns the byte length of the NUL-terminated
@@ -53,8 +58,10 @@ pub unsafe extern "C" fn ffi_probe_echo_view(data: *const u8, len: usize) -> usi
 /// `data` must be a valid NUL-terminated C string for reads up to its terminator.
 #[no_mangle]
 pub unsafe extern "C" fn ffi_probe_echo_cstr(data: *const std::os::raw::c_char) -> usize {
-    if data.is_null() {
-        return 0;
-    }
-    std::ffi::CStr::from_ptr(data).to_bytes().len()
+    c_abi!(0, {
+        if data.is_null() {
+            return 0;
+        }
+        std::ffi::CStr::from_ptr(data).to_bytes().len()
+    })
 }

package/rust/ffi/route.rs

@@ -11,8 +11,7 @@
 
 use std::slice;
 
-use super::util::panic_guard;
-
+use super::util::{c_abi, panic_guard};
 /// Compile a route descriptor into an opaque handle (`0` = failure / null
 /// input / panic). The handle is an owned `Box<NativeRoute>`; release it with
 /// {@link castrum_route_destroy}.
@@ -79,7 +78,9 @@ pub unsafe extern "C" fn castrum_route_run(
 /// most once.
 #[no_mangle]
 pub unsafe extern "C" fn castrum_route_destroy(handle: u64) {
-    if handle != 0 {
-        drop(Box::from_raw(handle as *mut crate::ingress::NativeRoute));
-    }
+    c_abi!((), {
+        if handle != 0 {
+            drop(Box::from_raw(handle as *mut crate::ingress::NativeRoute));
+        }
+    })
 }

package/rust/ffi/task.rs

@@ -7,9 +7,8 @@
 
 use std::slice;
 
-use super::util::panic_guard;
+use super::util::{c_abi, panic_guard};
 use crate::task;
-
 /// Start the pool with `threads` workers (0 → runtime default).
 /// Returns `0` started, `1` already running, `2` internal error.
 #[no_mangle]
@@ -67,7 +66,7 @@ pub unsafe extern "C" fn castrum_task_drain(out: *mut u8, out_cap: usize) -> usi
 /// Completions waiting to be drained.
 #[no_mangle]
 pub extern "C" fn castrum_task_pending() -> u32 {
-    task::pending()
+    c_abi!(0, { task::pending() })
 }
 
 /// Submit an op that writes its result DIRECTLY into `out` (zero-copy output):
@@ -115,7 +114,7 @@ pub unsafe extern "C" fn castrum_task_submit_out(
 /// Mark `task_id` cancelled. Returns `1` when newly marked, `0` otherwise.
 #[no_mangle]
 pub extern "C" fn castrum_task_cancel(task_id: usize) -> u32 {
-    u32::from(task::mark_cancelled(task_id as u64))
+    c_abi!(0, { u32::from(task::mark_cancelled(task_id as u64)) })
 }
 
 /// Submit an op whose PAYLOAD is read IN PLACE from the caller's buffer
@@ -169,8 +168,10 @@ pub unsafe extern "C" fn castrum_task_submit_slice(
 /// thread (a `bun:ffi` `JSCallback({ threadsafe: true }).ptr`).
 #[no_mangle]
 pub extern "C" fn castrum_task_set_doorbell(cb: *const std::os::raw::c_void) -> u32 {
-    task::set_doorbell(cb as usize);
-    1
+    c_abi!(0, {
+        task::set_doorbell(cb as usize);
+        1
+    })
 }
 
 /// Stop the pool and drop pending completions. Returns `0`.
@@ -179,14 +180,16 @@ pub extern "C" fn castrum_task_set_doorbell(cb: *const std::os::raw::c_void) ->
 /// point must not call a JS callback the owner is about to close.
 #[no_mangle]
 pub extern "C" fn castrum_task_shutdown() -> u32 {
-    task::completion::clear_doorbell();
-    task::shutdown();
-    task::completion::clear();
-    0
+    c_abi!(0, {
+        task::completion::clear_doorbell();
+        task::shutdown();
+        task::completion::clear();
+        0
+    })
 }
 
 /// Configured pool worker count (0 before the pool starts).
 #[no_mangle]
 pub extern "C" fn castrum_task_threads() -> u32 {
-    task::threads()
+    c_abi!(0, { task::threads() })
 }

package/rust/ffi/tests.rs

@@ -2528,3 +2528,98 @@ fn metrics_record_batch_c_abi() {
     assert!(text.contains("batch_total{k=\"v\"} 4"));
     unsafe { castrum_metrics_destroy(h) };
 }
+
+// ── Panic-containment contract ─────────────────────────────────
+
+/// Every `#[no_mangle]` export must route through `c_abi!`/`panic_guard`.
+///
+/// A panic unwinding through an `extern "C"` frame is undefined behaviour and
+/// aborts the host process (Bun), which is exactly the failure mode the
+/// `11-concurrent-burst` crash exposed. This source-level guard makes a new,
+/// unguarded export a test failure rather than a production SIGABRT.
+#[test]
+fn every_c_abi_export_is_panic_guarded() {
+    const SOURCES: &[(&str, &str)] = &[
+        ("crypto.rs", include_str!("crypto.rs")),
+        ("hashing.rs", include_str!("hashing.rs")),
+        ("http.rs", include_str!("http.rs")),
+        ("ingress.rs", include_str!("ingress.rs")),
+        ("json.rs", include_str!("json.rs")),
+        ("jwt.rs", include_str!("jwt.rs")),
+        ("metrics.rs", include_str!("metrics.rs")),
+        ("payload.rs", include_str!("payload.rs")),
+        ("probe.rs", include_str!("probe.rs")),
+        ("rate_limit.rs", include_str!("rate_limit.rs")),
+        ("route.rs", include_str!("route.rs")),
+        ("task.rs", include_str!("task.rs")),
+        ("validators.rs", include_str!("validators.rs")),
+    ];
+
+    let mut missing = Vec::new();
+    for (file, source) in SOURCES {
+        let mut rest = *source;
+        while let Some(idx) = rest.find("#[no_mangle]") {
+            let item = &rest[idx..];
+            let next = item[1..]
+                .find("#[no_mangle]")
+                .map(|i| i + 1)
+                .unwrap_or(item.len());
+            let guarded = item[..next].contains("c_abi!") || item[..next].contains("panic_guard");
+            if !guarded {
+                let name = item
+                    .split("fn ")
+                    .nth(1)
+                    .and_then(|s| s.split(['(', '<', ' ']).next())
+                    .unwrap_or("<unknown>");
+                missing.push(format!("{file}:{name}"));
+            }
+            rest = &item[next..];
+        }
+    }
+
+    assert!(
+        missing.is_empty(),
+        "C-ABI exports without a panic guard: {missing:?}"
+    );
+}
+
+/// Malformed-input fuzz over the packed C-ABI parsers + the per-route frame.
+///
+/// Calls the real `extern "C"` entry points (not just their cores) with
+/// arbitrary bytes and arbitrary output capacities: every call must return a
+/// value, never panic. This is the Rust-side half of the fuzz requirement
+/// (the JS-side harness lives in `scripts/`).
+#[test]
+fn packed_parsers_never_panic_on_hostile_c_abi_input() {
+    use crate::test_support::Rng;
+
+    let mut rng = Rng(0xabad_1dea);
+    let desc = route_desc_parse_both();
+    let handle = unsafe { castrum_route_compile(desc.as_ptr(), desc.len()) };
+
+    for _ in 0..2_000 {
+        let len = (rng.next() % 128) as usize;
+        let data = rng.bytes(len);
+        let mut out = vec![0u8; (rng.next() % 96) as usize];
+        let (ptr, plen) = (data.as_ptr(), data.len());
+        let (optr, ocap) = (out.as_mut_ptr(), out.len());
+
+        unsafe {
+            let _ = castrum_http_parse_request_packed(ptr, plen, optr, ocap);
+            let _ = castrum_query_parse_packed(ptr, plen, optr, ocap);
+            let _ = castrum_cookie_parse_packed(ptr, plen, optr, ocap);
+            let _ = castrum_form_parse_packed(ptr, plen, optr, ocap);
+            let _ = castrum_multipart_parse_packed(ptr, plen, ptr, plen, optr, ocap);
+            let _ = castrum_ws_frame_decode_packed(ptr, plen, optr, ocap);
+            let _ = castrum_base64_decode(ptr, plen, optr, ocap, (rng.next() & 1) as u8, 1);
+            let _ = castrum_hex_validate_batch(ptr, plen, (rng.next() % 40) as u32, optr, ocap);
+            if handle != 0 {
+                let _ = castrum_route_run(handle, ptr, plen, optr, ocap);
+            }
+        }
+    }
+
+    if handle != 0 {
+        unsafe { castrum_route_destroy(handle) };
+    }
+}