fix(dd): admit padded buffers before allocation

[chaliy]

What changed

dd conv=sync admits the complete padded payload before allocation and zero-fill.
Checked padding arithmetic enforces the 64 MiB copy cap, and the existing shared
execution budget owns the copy buffer's capacity through output handling. Stdout
cached text uses the same admission boundary. Ordinary
block copies retain padding, count, seek, output and error behavior.

Why

Previously the input cap ran before a plain vector resize. Padding could therefore
exceed the copy cap and bypass the request's live-memory budget.

Before / After

Tiny failing-first fixtures (maximum allocated payload: eight bytes):

Before: 3 passed; 3 failed
  padding-size admission ignored the byte cap
  eight-byte padding ignored a four-byte live budget
  retained copy held no lease
After: 8 dd unit tests passed; 3 ordinary integration tests passed

Ordinary CLI smoke:

$ printf abcde | dd ibs=4 obs=2 conv=sync status=noxfer | od -An -tx1
 61 62 63 64 65 00 00 00
1+1 records in
4+0 records out

Eight tiny GNU dd comparisons match stdout, stderr and status. VFS tests preserve
seek/notrunc and excl/nocreat failures. Inert version-banner fixtures recognize
GNU dd on Linux and macOS and reject unrelated tools. Compile-only all-feature Clippy, lean
Clippy, formatting, OKF, documentation links, capability/workflow parity, changelog
validation and frozen cargo-vet pass.

Local execution is limited to tiny cases. The existing, unchanged GitHub CI is
explicitly authorized to run full suites. Broad local suites and duplicate
benchmarks are excluded by the batch scope; no CI, tests, caps or hooks changed.
No resource-exhaustion script was executed.

Risk

• Medium: copy capacity now participates in the request's shared memory budget;
  calls exceeding that budget return a resource-limit error.
• Raw input/device reads and destination-file storage retain their existing paths;
  this change addresses the padded copy buffer only.

Checklist

• Tests added or updated
• Backward compatibility considered
• Scoped knowledge and public security guidance updated
• Existing unchanged GitHub CI green (49 checks)
• Complete review state checked; no outstanding material comments

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	6a9ffbf	Commit Preview URL Branch Preview URL	Oct 13 2026, 05:42 AM