In buildParseMetaV2's write loop a word's probe can walk past the last populated layer. expansions[s] is zero there, so pos collapses to cumulativePos, which points one item past the end of the items region, and the mload/mstore at that position touch memory beyond the bytes array.
Reaching it requires an earlier-indexed word to take a later word's layer slot, so it is not easy to hit from a random word set. It would surface as InvalidParseMeta or a lookup failure, never as DuplicateFingerprint.
Found while bounding the DuplicateFingerprint fuzz flake on main; deliberately not folded into that change, which touches no production code.
In
buildParseMetaV2's write loop a word's probe can walk past the last populated layer.expansions[s]is zero there, soposcollapses tocumulativePos, which points one item past the end of the items region, and themload/mstoreat that position touch memory beyond thebytesarray.Reaching it requires an earlier-indexed word to take a later word's layer slot, so it is not easy to hit from a random word set. It would surface as
InvalidParseMetaor a lookup failure, never asDuplicateFingerprint.Found while bounding the
DuplicateFingerprintfuzz flake onmain; deliberately not folded into that change, which touches no production code.