RUSTSEC-2026-0452: Out-of-bounds read when decoding internal keys shorter than 16 bytes

InternalKeyRef::fromencoded is a safe constructor whose only length check is debugassert!(encoded.len() >= 16), which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: userkey() slices &encoded[..len - 16], trailer()/seqnum() pass len - 16 and timestamp() passes len - 8 to readu64be, which computes buffer.asptr().add(offset) and performs an 8-byte load. For a short slice the subtraction underflows usize, the pointer wraps below the allocation and eight bytes before the buffer are read (undefined behavior; confirmed with AddressSanitizer as a heap-buffer-overflow). In debug builds the same call panics instead.

The same invariant is missing at the on-disk decode boundary: BlockIterator::seeknextentry rebuilds the current key from block bytes with upper-bound checks only, and BlockIterator::key() wraps it in InternalKeyRef, which surrealdb's kv-surrealkv backend then reads through keyref.timestamp(). A crafted or corrupted SSTable therefore reaches the same unchecked subtraction without any unsafe at the call site.

1.2.0 rejects internal keys shorter than their 8-byte trailer before any accessor computes an offset and makes the accessors bounds-checked (fix in commit ac642f9, surrealdb 4.0.0 ships surrealkv 1.2.0).