serde_2026: dedicated panic-finder fuzz target

The existing serde-2026 fuzzer is a roundtrip checker — it Corpus::Reject's
any blob that fails to fully decode, which means libfuzzer never accumulates
seeds for the "almost-decodes-then-aborts" failure mode. The historical
de.rs OOM (tiny blob declaring instruction_count = 2^54, abort in
Vec::with_capacity before any instruction is read) lives in exactly that
bucket and was not surfaced by the existing fuzzer; it took Cursor's
static analysis to find.

Add serde-2026-panic, which feeds arbitrary bytes to all three public
entry points — deserialize_2026_body, node_from_bytes_serde_2026,
serialized_length_serde_2026 — under both strict={false,true}, and
asserts only that nothing panics, aborts, or overflows the stack.
Result::Err is fine; SIGABRT, unwinding panic, or SO is a bug.

CI's existing fuzz job auto-discovers targets via `cargo +nightly fuzz list`
and gives each 30s, so no workflow change is needed.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: richardkiss

fuzz/Cargo.toml

@@ -160,3 +160,9 @@ name = "serde-2026-varint"
 path = "fuzz_targets/serde_2026_varint.rs"
 test = false
 doc = false
+
+[[bin]]
+name = "serde-2026-panic"
+path = "fuzz_targets/serde_2026_panic.rs"
+test = false
+doc = false

fuzz/fuzz_targets/serde_2026_panic.rs

@@ -0,0 +1,41 @@
+#![no_main]
+
+//! Panic-finder for the serde_2026 entry points.
+//!
+//! Companion to `serde_2026.rs` (which proves *correctness* via roundtrip on
+//! valid inputs) and `serde_2026_varint.rs` (which targets the varint codec).
+//! This target proves *robustness*: feed every entry point arbitrary bytes
+//! under both `strict={false,true}` and assert only that none of them panic,
+//! abort, or stack-overflow. `Result::Err` is fine; `Ok` is fine. A SIGABRT
+//! from `handle_alloc_error`, an unwinding panic, or a stack overflow is a
+//! bug.
+//!
+//! This deliberately drops the `Corpus::Reject` filter that
+//! `serde_2026.rs` uses, so libfuzzer keeps mutating around blobs that fail
+//! validation — the historical OOM at `de.rs` (a tiny blob declaring
+//! `instruction_count = 2^54`) lives in exactly that "fails validation but
+//! aborts before erroring" bucket.
+
+use clvmr::Allocator;
+use clvmr::serde_2026::{
+    deserialize_2026_body, node_from_bytes_serde_2026, serialized_length_serde_2026,
+};
+use libfuzzer_sys::fuzz_target;
+
+const FUZZ_MAX_ATOM_LEN: usize = 1 << 20;
+
+fuzz_target!(|data: &[u8]| {
+    for strict in [false, true] {
+        // Body-only deserializer — slice length is the natural bound.
+        let mut a = Allocator::new();
+        let _ = deserialize_2026_body(&mut a, data, FUZZ_MAX_ATOM_LEN, strict);
+
+        // Prefix-aware deserializer — same body parser, plus magic-prefix strip.
+        let mut a = Allocator::new();
+        let _ = node_from_bytes_serde_2026(&mut a, data, FUZZ_MAX_ATOM_LEN, strict);
+
+        // Length probe — walks the wire format without building a tree, so
+        // it has its own opportunity to allocate or recurse pathologically.
+        let _ = serialized_length_serde_2026(data, FUZZ_MAX_ATOM_LEN, strict);
+    }
+});