0.31.0: hardening and correctness pass across mux, codec, AACS/CSS, UDF/MPLS/CLPI, recovery, drive/SCSI, labels, and I/O

Library-wide review-and-fix pass: tightened AACS keydb/handshake/variant
handling and trailing-partial-unit policy, corrected MPLS mark offset and
added UDF allocation bounds, hardened the mux/codec framing and M2TS paths,
guarded SCSI READ CAPACITY short transfers and unified error mapping, added
overflow guards on untrusted disc input, and made prefetch shutdown
deterministic. Release profile now builds with thin LTO + single codegen unit.

src/mux/stdio.rs

@@ -15,7 +15,12 @@ pub struct StdioStream {
     writer: Option<io::BufWriter<io::Stdout>>,
     header_written: bool,
     header_read: bool,
-    stored_codec_privates: Vec<Option<Vec<u8>>>,
+    /// True once an FMKV header was actually parsed on the read side
+    /// (set only inside the `Some(meta)` arm). Distinct from
+    /// `header_read`, which is true after the first read attempt even
+    /// when no header was present — `headers_ready()` must gate on the
+    /// metadata actually being available, not merely on having looked.
+    meta_parsed: bool,
 }
 
 impl StdioStream {
@@ -27,7 +32,7 @@ impl StdioStream {
             writer: None,
             header_written: false,
             header_read: false,
-            stored_codec_privates: Vec::new(),
+            meta_parsed: false,
         }
     }
 
@@ -39,10 +44,25 @@ impl StdioStream {
             writer: Some(io::BufWriter::new(io::stdout())),
             header_written: false,
             header_read: false,
-            stored_codec_privates: Vec::new(),
+            meta_parsed: false,
         }
     }
 
+    /// Write the FMKV metadata header to stdout exactly once, before any
+    /// frames. Always writes (even when the title has no streams) so a
+    /// zero-frame output stream still emits the magic + metadata header,
+    /// keeping the wire protocol symmetric with the read side's read_header().
+    fn ensure_header_written(&mut self) -> io::Result<()> {
+        if let Some(w) = &mut self.writer {
+            if !self.header_written {
+                let m = meta::M2tsMeta::from_title(&self.disc_title);
+                meta::write_header(w, &m)?;
+                self.header_written = true;
+            }
+        }
+        Ok(())
+    }
+
     /// Read the FMKV metadata header from stdin on first read.
     fn ensure_header_read(&mut self) -> io::Result<()> {
         if self.header_read {
@@ -50,10 +70,16 @@ impl StdioStream {
         }
         self.header_read = true;
         if let Some(ref mut r) = self.reader {
-            if let Ok(Some(m)) = meta::read_header(r) {
-                let title = m.to_title();
-                self.stored_codec_privates = title.codec_privates.clone();
-                self.disc_title = title;
+            // Propagate real header errors. read_header consumes bytes
+            // from the unbuffered stdin BEFORE it can fail (oversized
+            // length, bad JSON, partial read), so swallowing the Err
+            // would leave the stream misaligned and PesFrame::deserialize
+            // would then read garbage. `?` surfaces the true error;
+            // Ok(None) (genuine magic mismatch / clean EOF) stays a
+            // non-error and leaves the empty default title in place.
+            if let Some(m) = meta::read_header(r)? {
+                self.disc_title = m.to_title();
+                self.meta_parsed = true;
             }
         }
         Ok(())
@@ -69,21 +95,20 @@ impl crate::pes::Stream for StdioStream {
         }
     }
     fn write(&mut self, frame: &crate::pes::PesFrame) -> io::Result<()> {
+        if self.writer.is_none() {
+            return Err(crate::error::Error::StreamReadOnly.into());
+        }
+        self.ensure_header_written()?;
         match &mut self.writer {
-            Some(w) => {
-                if !self.header_written {
-                    if !self.disc_title.streams.is_empty() {
-                        let m = meta::M2tsMeta::from_title(&self.disc_title);
-                        meta::write_header(w, &m)?;
-                    }
-                    self.header_written = true;
-                }
-                frame.serialize(w)
-            }
+            Some(w) => frame.serialize(w),
             None => Err(crate::error::Error::StreamReadOnly.into()),
         }
     }
     fn finish(&mut self) -> io::Result<()> {
+        // Emit the header even when write() was never called, so a zero-frame
+        // title still produces the FMKV magic + metadata header on stdout
+        // (symmetric with the read side's read_header()).
+        self.ensure_header_written()?;
         if let Some(w) = &mut self.writer {
             w.flush()?;
         }
@@ -94,13 +119,23 @@ impl crate::pes::Stream for StdioStream {
     }
 
     fn codec_private(&self, track: usize) -> Option<Vec<u8>> {
-        self.stored_codec_privates
+        // Single source of truth: the title's own codec_privates. (The
+        // previous `stored_codec_privates` field was a redundant clone
+        // of exactly this, populated from the same header.)
+        self.disc_title
+            .codec_privates
             .get(track)
             .and_then(|c| c.clone())
     }
 
     fn headers_ready(&self) -> bool {
-        // After first read(), header is parsed and codec_privates populated
-        self.header_read || self.writer.is_some()
+        // Write side: caller supplied the title up front, so headers are
+        // always ready. Read side: ready only once an FMKV header was
+        // actually parsed — gating on `header_read` alone would claim
+        // readiness for a headerless stream whose codec_private() is None
+        // for every track, starving the downstream MKV writer of init
+        // data. A genuinely headerless stream never flips ready (the
+        // caller must then fall back to its own codec detection).
+        self.writer.is_some() || self.meta_parsed
     }
 }