[kixelated]

Summary

Triage of the scheduled Nightly on 2026-11-06, which failed only Fuzz (annexb).

• Finding: deterministic, not intermittent. The panic is attempt to add with overflow at scuffle-av1-0.1.4/src/obu/utils.rs:24: read_uvlc counts leading zeros in a u8, and an AV1 sequence header whose picture interval has 256 leading zeros overflows it.
• Already fixed: moq-dev/moq#8042 merged at 23:29Z, after the 14:41Z run on fbef872. It committed this exact 148-byte input as regressions/annexb/crash-512747cda72c7fdde13583798f5f80e6807a9e69 (byte-identical to the run's Base64). read_uvlc has one caller in scuffle-av1 (seq.rs:176, timing info), and fix(mux): reject overflowing AV1 picture intervals #8042 guards that path, so no code change is needed here.
• This PR: records the triage in the epic and adds a ## Waiting item, because no upstream ScuffleCloud/scuffle issue exists for scuffle-av1. The epic stays: no Nightly has run every media target green yet.

Impact

Quest docs only. No public API or wire changes.

Checks

• cargo test -p moq-mux --features fuzz --lib fuzz::tests::regressions on main plus this branch: passed, replaying the committed input.
• quest check and quest check --base origin/main: ok.

Choices made without asking

• Did not dispatch an extra Nightly. The next scheduled run is the epic's check.

Recorded wait (in the epic's ## Waiting)

This PR records the wait, so the wait does not block merging. Maintainer: approve filing an upstream issue on ScuffleCloud/scuffle for the scuffle-av1 read_uvlc u8 leading-zero overflow, as was done for scuffle-h265 (ScuffleCloud/scuffle#653) and scuffle-expgolomb (ScuffleCloud/scuffle#654). Agents need approval to post outside kixelated and moq-dev. Recommend approving. Draft: "read_uvlc (src/obu/utils.rs) counts leading zeros in a u8; a sequence header whose num_ticks_per_picture_minus_1 has 256+ leading zero bits panics with add-overflow in debug builds (and wraps in release). The AV1 spec caps the value at 2^32 - 2 (31 leading zeros), so the loop can stop at 32 zeros and return an error." Done once the issue is filed and linked in the epic.

Follow-ups

None.

Review

Skipped for head 7373e6d: the diff is quest prose recording a triage, with no code; the last change only scopes the README's PR links to their dates. quest check --base origin/main passes, and the claims are checked above against the run log, moq-dev/moq#8042, and scuffle-av1 0.1.4's source.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c8c06a2e-c343-4dd4-bf5b-1da2063f5329

Commits

Reviewing files that changed from the base of the PR and between ce0a4f0 and 7373e6d.

Files selected for processing: 1

• quest/m1/fuzz-findings/README.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed a3c52b2 against base ce0a4f0. No actionable findings in the README update.

The Nightly annexb log records the scuffle-av1 utils.rs:24 overflow and matching crash filename. #8042 merged after that run; the bounded timing guard and regression-file replay path remain present. Annexb was the only failing Fuzz job, supporting the changed epic's media-fuzz triage. The epic remains open for a green scheduled run and preserves approval before upstream outreach.

Scope clarification: the PR body's opening 'failed only Fuzz (annexb)' should be read as the fuzz subset; the entire Nightly had unrelated non-fuzz failures. The changed README is correctly scoped.

Verification limits: GitHub-only source/log review. No test replay or hardware checks. Binary regression byte identity was not independently verified through the text connector. Exact-head Check is still in progress: https://github.com/moq-dev/moq/actions/runs/42327567589.

(Written by review (OpenAI))

[pullfrog]

ℹ️ Minor suggestions only.

Reviewed changes

This run reviewed the quest-only triage record for the 2026-11-06 Nightly annexb finding, checked against the run log, #8042, and scuffle-av1 0.1.4.

• Annexb finding recorded — adds the 2026-11-06 scuffle-av1 read_uvlc overflow to the epic's triage list, citing #8042 as the fix that merged after the run with the input committed, and noting the other fuzz targets passed.
• Upstream report wait — adds a ## Waiting item asking the maintainer to approve filing the overflow on ScuffleCloud/scuffle, which has no issue for it.

ℹ️ The PR description overstates the 11-06 run's failure scope

The description says the Nightly "failed only Fuzz (annexb)", but that run failed 14 jobs, including Media (firefox player), Audio quality, and Nightly (OBS). The README bullet's "the other targets passed" is correctly scoped to the fuzz jobs, so only the description needs the same scoping.

Technical details

# Scope the failure claim to the fuzz targets

## Affected sites
- PR description, first Summary bullet — "which failed only Fuzz (annexb)".

## Evidence
- `gh api 'repos/moq-dev/moq/actions/runs/42236107954/jobs?per_page=100' --jq '[.jobs[] | select(.conclusion=="failure") | .name]'` returns 14 names: `Media (firefox player)`, `Audio quality`, `Nightly (Relay session benchmarks)`, `Tests (test resume-model)`, `Nightly (Rust coverage)`, `Nightly (Rust benchmark tests)`, `Tests (rs miri)`, `Nightly (OBS)`, `Nightly (Browser benchmark smoke)`, `ietf-conformance / moxygen`, `Nightly (OBS TSan)`, `Tests (gate)`, `Fuzz (annexb)`, `features / Features (rs features)`.
- Of the 22 fuzz jobs, only `Fuzz (annexb)` failed.

## Required outcome
- The description says the run's fuzz targets were otherwise green (or that only that fuzz target failed), so the epic's record is not read as the whole Nightly having been green apart from `annexb`.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ The link scoping fix is correct; one description nit remains.

The new commit resolves the prior inline concern: the heading now scopes #7961 to 2026-11-05 and links #8042 with this triage for 2026-11-06, so each link matches the dates it covers.

The PR description still says the 11-06 Nightly "failed only Fuzz (annexb)", but that run failed 14 jobs, including Media (firefox player), Audio quality, and Nightly (OBS); only among the fuzz jobs did just Fuzz (annexb) fail. Scoping the sentence to the fuzz targets would match the README's "the other targets passed".

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}