0.31.0: hardening and correctness pass across mux, codec, AACS/CSS, UDF/MPLS/CLPI, recovery, drive/SCSI, labels, and I/O

Library-wide review-and-fix pass: tightened AACS keydb/handshake/variant
handling and trailing-partial-unit policy, corrected MPLS mark offset and
added UDF allocation bounds, hardened the mux/codec framing and M2TS paths,
guarded SCSI READ CAPACITY short transfers and unified error mapping, added
overflow guards on untrusted disc input, and made prefetch shutdown
deterministic. Release profile now builds with thin LTO + single codegen unit.

src/io/sink/preallocate/linux.rs

@@ -5,13 +5,16 @@
 //! the file naturally.
 
 use std::fs::File;
-#[cfg(unix)]
 use std::os::unix::io::AsRawFd;
 
 pub(super) fn preallocate_impl(file: &File, size_bytes: u64) {
     let fd = file.as_raw_fd();
+    // Clamp to the signed `off_t` range fallocate expects; an unchecked
+    // `as i64` cast would wrap a >= 2^63 size to a negative length that
+    // fallocate rejects with EINVAL (silent no-op).
+    let len = i64::try_from(size_bytes).unwrap_or(i64::MAX);
     // FALLOC_FL_KEEP_SIZE = 0x01.
-    let rc = unsafe { libc::fallocate(fd, libc::FALLOC_FL_KEEP_SIZE, 0, size_bytes as i64) };
+    let rc = unsafe { libc::fallocate(fd, libc::FALLOC_FL_KEEP_SIZE, 0, len) };
     tracing::debug!(
         target: "mux",
         "LocalFileSink fallocate size_hint={size_bytes} rc={rc} ok={}",

src/io/sink/preallocate/macos.rs

@@ -1,7 +1,8 @@
 //! macOS `F_PREALLOCATE` extent reservation.
 //!
-//! `fcntl(F_PREALLOCATE)` with `F_ALLOCATECONTIG` first (try for a
-//! contiguous run) and fall back to `F_ALLOCATEALL` (non-contig OK).
+//! `fcntl(F_PREALLOCATE)` with `F_ALLOCATECONTIG | F_ALLOCATEALL` first
+//! (prefer a contiguous run but accept scattered extents to satisfy the
+//! full length) and fall back to `F_ALLOCATEALL` alone on failure.
 //! Reported file size is unchanged — the muxer's writes still grow it.
 
 use std::fs::File;
@@ -13,16 +14,24 @@ use crate::io::platform_macos::{
 
 pub(super) fn preallocate_impl(file: &File, size_bytes: u64) {
     let fd = file.as_raw_fd();
+    // Clamp to the signed `off_t` range; an unchecked `as off_t` cast
+    // would wrap a >= 2^63 size to a negative length.
+    let len = i64::try_from(size_bytes).unwrap_or(i64::MAX) as libc::off_t;
     let mut store = Fstore {
-        fst_flags: F_ALLOCATECONTIG,
+        // Prefer a contiguous run but accept scattered extents to
+        // satisfy the full length. Without F_ALLOCATEALL the first
+        // attempt is best-effort and can return rc=0 with a partial
+        // allocation, so the fallback below would never fire. Matches
+        // writeback_file/macos.rs.
+        fst_flags: F_ALLOCATECONTIG | F_ALLOCATEALL,
         fst_posmode: F_PEOFPOSMODE,
         fst_offset: 0,
-        fst_length: size_bytes as libc::off_t,
+        fst_length: len,
         fst_bytesalloc: 0,
     };
     let mut rc = unsafe { libc::fcntl(fd, F_PREALLOCATE, &mut store as *mut Fstore) };
     if rc == -1 {
-        // Fall back to non-contiguous.
+        // Fall back to non-contiguous only.
         store.fst_flags = F_ALLOCATEALL;
         rc = unsafe { libc::fcntl(fd, F_PREALLOCATE, &mut store as *mut Fstore) };
     }