[kixelated]

Finishes quest/m1/fuzz-findings/ts-step-scan.md, one child of the media fuzz findings epic.

Summary

The ts fuzz target's 567-byte input from the moq-dev/moq#7313 findings comment overflowed self.scan - self.at in Ahead::scan (rs/moq-mux/src/container/ts/step.rs).

Cause. Steps::judge gave trigger the demux cursor from before peek. If the framer had to resync past junk to find the packet that showed the step, that packet's offset at was ahead of the cursor, so the look-ahead began with scan < at. In debug builds the staging check panicked. In release builds it wrapped to a huge value, so the look-ahead returned Err(scan) at once. That cleared a point before the step and skipped judging it.

Fix. The look-ahead now starts at at, with the framer that peek locked onto that packet, so it reads that packet again first, as it always did. scan can no longer be behind at, and the subtraction stays unsaturated. The restart's remainder and the demux drain still use the routed cursor, so the junk before the step still goes to the next instance.

• a_resync_before_the_step_reads_on_from_it is a new unit test that splices 5 junk bytes before a switch, built with the module's pes/second helpers. It panics with the same overflow on main and passes with the fix.
• The fuzz input is committed as rs/moq-mux/fuzz/regressions/ts/step-scan, which fuzz::tests::regressions replays.
• The quest file and its link in the epic README are removed.

Public API: none. Wire: none.

Checks

• cargo fmt --all --check: passes
• cargo clippy -p moq-mux --all-targets --all-features -- -D warnings: passes
• cargo test -p moq-mux --all-features: 1988 passed, 3 ignored, plus doc and example tests
• quest check: passes

Only moq-mux was built (disk on the host is tight). Its change touches no other crate.

Choices made without asking

• I named the regression input ts/step-scan, matching the quest name, as mkv/short-block-header matches its finding.

Review

• Reviewer: Codex (quest review), gpt-6.1-sol, medium effort
• Head: 2192b19, round 1
• Findings: none

(Written by Claude Opus 5.5)

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 2192b19

No actionable bugs found. Starting look-ahead at the located packet fixes the ordering invariant directly, and the focused test plus fuzz input cover the resynchronization case.

Static GitHub review only; I did not run tests or fuzzing.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Steps::judge now passes the framer state positioned by demux.peek to trigger. The look-ahead scan starts at the step packet offset. A regression test adds junk before a switch and checks rewind detection and duration. The related fuzz-finding entry and document were removed.

Merge Risk: Minimal · up to 2192b

The change aligns TS look-ahead with the packet that triggered detection and adds regression coverage. No actionable merge-blocking risk is established by the available evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: starting TS step look-ahead at the packet that showed the step.
Description check		The description directly explains the TS fuzz finding, its cause, the fix, regression coverage, and validation results.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 3 functions across 1 files.

Finishing Touches

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

Clippy (1.99.0)

Clippy execution timed out

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 840127b3-e3a7-4de8-a7ca-d4fe06d7cfcb

Commits

Reviewing files that changed from the base of the PR and between 3d927ca and 2192b19.

Files selected for processing: 4

• quest/m1/fuzz-findings/README.md
• quest/m1/fuzz-findings/ts-step-scan.md
• rs/moq-mux/fuzz/regressions/ts/step-scan
• rs/moq-mux/src/container/ts/step.rs

Files with no reviewable changes: 1

• quest/m1/fuzz-findings/ts-step-scan.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.

[pullfrog]

✅ No new issues found.

Reviewed changes — full PR (4 files, 2 commits):

• Steps::judge seeds the look-ahead at the step packet — trigger now receives the post-peek framer (synced onto the packet at at) and sets scan: at, so the look-ahead can no longer begin with scan < at. This eliminates the self.scan - self.at underflow in Ahead::scan that panicked in debug and wrapped to a huge Err in release, skipping the step.
• New unit test a_resync_before_the_step_reads_on_from_it — inserts 5 junk bytes before a switch and asserts the rewind is still judged, exercising the resync path the fix targets.
• Fuzz regression rs/moq-mux/fuzz/regressions/ts/step-scan — the 567-byte ts input, replayed by fuzz::tests::regressions.
• Quest cleanup — ts-step-scan.md and its README link removed.

I verified the mechanics against Demux::peek/cursor and Framer::next: peek returns the packet-start offset and leaves the framer synced there, and cursor <= at always, so scan: at reproduces the old scan progression exactly after the first iteration while replacing the underflowing initial staging check with 0. I also ran container::ts::step::tests (5 passed) and confirmed the new test fails with attempt to subtract with overflow at step.rs:425 when scan is seeded from the pre-peek cursor, so the regression coverage is genuine.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}