Harden mux + decrypt paths; fail-loud on unresolvable keys

mp4 demuxer (untrusted input): bound every allocation sized from a box
field (stsz/stco/stsc counts, stts/ctts run-lengths, per-sample and moov
sizes, plus an absolute cap so a sparse file can't inflate file_len);
guard the parse_stsd slice and a zero mdhd timescale; cap track count so
the per-track PID can't overflow; rewrite read_moov to handle size==0 /
size<8 / 64-bit largesize; parse esds/AudioSpecificConfig for AAC; write
tkhd duration in the movie timescale.

decrypt: resolve_mux_key_map now fails loud on an extent no key can
classify instead of inheriting the previous extent's key, so a keymap
never silently carries a wrong key; the sweep/patch key-fetch recovery
fails loud when a unit is still unresolved after the retry.

AACS: reject inverted forensic segments in both range builders; compare
the forensic index in u16 space so an out-of-range value can't truncate
onto a valid u8 index. RECOVERED_ERROR no longer latches the damage zone,
preserving the 30s wedge cooldown for a following hard error.

audio: AAC/MP2/MP3/FLAC carry the last PTS across a PES with no timestamp;
the DTS-HD extension-sync search is bounded to after the core; the MP4
16.16 sample-rate field saturates. demux_sink records the video reference
before the kind filter so audio:// / sub:// keep multi-clip PTS continuity
and the DELAY tag.

Remove a dead error variant and the AACS-unsupported-video code; codec
comments cite the primary format specs; assorted doc/naming fixes and
regression tests throughout.

src/mux/codec/ac3.rs

@@ -118,13 +118,13 @@ impl Ac3Parser {
 
 use super::crc::crc16_ansi;
 
-/// Whether a fully-buffered (E-)AC-3 frame passes its native CRC. ffmpeg's
-/// decoder checks exactly this — `av_crc(AV_CRC_16_ANSI, 0, &buf[2],
-/// frame_size - 2) == 0` (ac3dec.c) — over the frame after the 2-byte syncword;
-/// the trailing crc word makes a clean frame's residue zero. A nonzero residue
-/// is a ~1-in-65536-certain sign of payload corruption, so we drop the frame
-/// (silence gap) rather than ship a glitch. `frame` must be exactly the frame
-/// bytes (syncword .. frame_size).
+/// Whether a fully-buffered (E-)AC-3 frame passes its native CRC. Per ETSI TS
+/// 102 366 (ATSC A/52) the frame carries a CRC-16/ANSI (poly 0x8005, init 0,
+/// non-reflected) over the bytes after the 2-byte syncword — i.e. `crc16_ansi(
+/// &buf[2..]) == 0` covers `frame_size - 2` bytes; the trailing crc word makes a
+/// clean frame's residue zero. A nonzero residue is a ~1-in-65536-certain sign
+/// of payload corruption, so we drop the frame (silence gap) rather than ship a
+/// glitch. `frame` must be exactly the frame bytes (syncword .. frame_size).
 fn frame_crc_ok(frame: &[u8]) -> bool {
     // Need the syncword (2) plus at least one covered byte; the caller only
     // invokes this on a fully-sized frame, so this is defensive.
@@ -136,8 +136,8 @@ fn frame_crc_ok(frame: &[u8]) -> bool {
 
 /// Decodability verdict for a fully-sized (E-)AC-3 frame: `Some(reason)` when it
 /// must be dropped, `None` when it decodes. Drops (in order): a poisoned track
-/// (mostly-undecodable → drop the rest), a bitstream id ffmpeg's parser rejects
-/// (`bsid > 16` → `AC3_PARSE_ERROR_BSID`), or a failed native frame CRC.
+/// (mostly-undecodable → drop the rest), an out-of-range bitstream id (`bsid >
+/// 16`; ETSI TS 102 366 defines no bsid above 16), or a failed native frame CRC.
 fn ac3_drop_reason(
     tally: &super::dropgate::DropTally,
     frame: &[u8],
@@ -233,7 +233,7 @@ impl CodecParser for Ac3Parser {
 
             let duration_ns = frame_duration_ns(remaining, bsid);
             let frame = &data[start..start + frame_size];
-            // Decodability gate: drop a frame ffmpeg's parser rejects (bsid > 16)
+            // Decodability gate: drop a frame with an out-of-range bsid (> 16)
             // or whose native CRC fails (payload corruption). `frame_pts_ns` is
             // advanced BELOW whether or not the frame survives, so a drop is a
             // silence gap and the following frames keep their true PTS.
@@ -385,8 +385,8 @@ const ACMOD_CHANNELS: [u8; 8] = [2, 1, 2, 3, 3, 4, 4, 5];
 ///
 /// This is the AUTHORITATIVE channel count for the track header: the DVD IFO
 /// `audio_attr_t.channels` nibble is a well-known unreliable/stale field, so
-/// the muxer prefers this over the IFO-claimed count (mirrors MakeMKV /
-/// HandBrake, which never trust the IFO audio nibble). LFE adds one channel
+/// the muxer prefers this over the IFO-claimed count (the bitstream acmod is
+/// authoritative; the IFO audio nibble is not trusted). LFE adds one channel
 /// (e.g. acmod=7 + lfeon → 6 = 5.1).
 ///
 /// Bit layout from the syncword (A/52 §5.3.2 BSI):
@@ -628,7 +628,7 @@ mod tests {
         // (PES marked discontinuity) carrying a fresh complete frame. The
         // truncated partial must be DROPPED, not spliced — otherwise the parser
         // emits one corrupt frame built from [stale partial | head of fresh] and
-        // strands the tail (FFmpeg: "incomplete frame" / wrong sync).
+        // strands the tail (decoders report "incomplete frame" / wrong sync).
         let mut parser = Ac3Parser::new();
         let frame_data = make_ac3_frame(0, 2); // 160 bytes, starts with 0x0B77
 
@@ -1463,8 +1463,8 @@ mod tests {
 
     #[test]
     fn bsid_over_16_is_dropped() {
-        // ffmpeg's parser rejects bsid > 16 (AC3_PARSE_ERROR_BSID). A frame with
-        // bsid = 17 that still sizes must be dropped, not emitted.
+        // bsid > 16 is out of range (ETSI TS 102 366 defines no bsid above 16).
+        // A frame with bsid = 17 that still sizes must be dropped, not emitted.
         let mut frame = vec![0u8; 128];
         frame[0] = 0x0B;
         frame[1] = 0x77;

src/mux/codec/adts.rs

@@ -1,20 +1,22 @@
 //! AAC ADTS decodability gate.
 //!
-//! ffmpeg's `ff_adts_header_parse` (adts_header.c) has exactly three hard
-//! rejects: syncword != 0xFFF, a reserved `sampling_frequency_index`
-//! (`ff_mpeg4audio_sample_rates[sr] == 0`, i.e. index ≥ 13), and
-//! `aac_frame_length < 7`. It does NOT verify the optional ADTS CRC (it only
-//! `skip_bits(16)` past it). So the gate mirrors those three rejects: a packet
-//! that begins with the ADTS sync but is otherwise malformed is dropped; a
-//! packet with no ADTS sync is raw AAC (e.g. from mp4, which carries no ADTS
-//! header) or a continuation and passes through unchanged — never false-dropped.
-//! Raw AAC has no per-frame integrity data, so like LPCM it cannot be gated.
+//! Per the ADTS framing defined in ISO/IEC 13818-7 / ISO/IEC 14496-3, a header
+//! is structurally invalid in exactly three ways this gate treats as hard
+//! rejects: syncword != 0xFFF, a reserved `sampling_frequency_index` (the sample
+//! rate table has 13 valid entries, so index ≥ 13 is reserved), and
+//! `aac_frame_length < 7` (shorter than the fixed+variable header itself). The
+//! optional 16-bit ADTS CRC is not verified here — it is simply skipped. So the
+//! gate enforces those three rejects: a packet that begins with the ADTS sync
+//! but is otherwise malformed is dropped; a packet with no ADTS sync is raw AAC
+//! (e.g. from an MP4 container, which carries no ADTS header) or a continuation
+//! and passes through unchanged — never false-dropped. Raw AAC has no per-frame
+//! integrity data, so like LPCM it cannot be gated.
 
 use super::dropgate::DropTally;
 use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
-/// `ff_mpeg4audio_sample_rates` — 13 valid entries; indices 13/14/15 are 0
-/// (reserved), which is exactly what ffmpeg rejects.
+/// ADTS `sampling_frequency_index` table (ISO/IEC 14496-3) — 13 valid entries;
+/// indices 13/14/15 are 0 (reserved) and constitute a hard reject.
 const ADTS_SAMPLE_RATE_VALID: [u32; 16] = [
     96000, 88200, 64000, 48000, 44100, 32000, 24000, 22050, 16000, 12000, 11025, 8000, 7350, 0, 0,
     0,
@@ -24,10 +26,10 @@ const ADTS_SAMPLE_RATE_VALID: [u32; 16] = [
 enum AdtsVerdict {
     /// No 12-bit ADTS sync at the head — not an ADTS frame we can validate.
     NoSync,
-    /// Sync present and the three ffmpeg-checked fields are legal.
+    /// Sync present and the three structural fields are legal.
     Valid,
     /// Sync present but a reserved sample-rate index or a sub-header
-    /// frame-length — ffmpeg's parser rejects this.
+    /// frame-length — structurally invalid per the ADTS spec.
     Invalid,
 }
 
@@ -56,6 +58,10 @@ fn adts_verdict(data: &[u8]) -> AdtsVerdict {
 
 pub struct AdtsParser {
     tally: DropTally,
+    /// Last emitted PTS (ns). A PES with no PTS (legal for audio, e.g. a
+    /// post-discontinuity continuation) carries this forward rather than resetting
+    /// the timeline to 0 — matching the AC-3/DTS parsers and preserving A/V sync.
+    last_pts_ns: i64,
 }
 
 impl Default for AdtsParser {
@@ -68,6 +74,7 @@ impl AdtsParser {
     pub fn new() -> Self {
         Self {
             tally: DropTally::new("aac"),
+            last_pts_ns: 0,
         }
     }
 
@@ -85,7 +92,12 @@ impl CodecParser for AdtsParser {
         if pes.data.is_empty() {
             return Vec::new();
         }
-        let pts_ns = pes.pts.or(pes.dts).map(pts_to_ns).unwrap_or(0);
+        let pts_ns = pes
+            .pts
+            .or(pes.dts)
+            .map(pts_to_ns)
+            .unwrap_or(self.last_pts_ns);
+        self.last_pts_ns = pts_ns;
 
         let drop =
             self.tally.is_poisoned() || matches!(adts_verdict(&pes.data), AdtsVerdict::Invalid);
@@ -162,6 +174,22 @@ mod tests {
         assert_eq!(p.dropped_frames(), 0);
     }
 
+    #[test]
+    fn pes_without_pts_carries_last_timestamp_not_zero() {
+        // A PES with no PTS (legal for audio, e.g. after a discontinuity) must
+        // carry the last known timestamp forward — resetting to 0 would corrupt
+        // A/V sync.
+        let mut p = AdtsParser::new();
+        p.parse(&make_pes(adts_frame(400), Some(90000)));
+        let f = p.parse(&make_pes(adts_frame(400), None));
+        assert_eq!(f.len(), 1);
+        assert_eq!(
+            f[0].pts_ns,
+            pts_to_ns(90000),
+            "carried forward, not reset to 0"
+        );
+    }
+
     #[test]
     fn reserved_sample_rate_index_is_dropped() {
         // sr_index = 13 (reserved). byte2 bits5..2 = 1101 → 0x34.

src/mux/codec/coding.rs

@@ -206,8 +206,8 @@ impl PictureInfo {
     }
 
     /// Number of field-display periods this picture occupies — the basis for
-    /// soft-telecine (2:3 pulldown) timing. MPEG-2 (ISO/IEC 13818-2 §6.3.10,
-    /// ffmpeg `nb_fields = repeat_pict + 2`): a field picture occupies 1 field,
+    /// soft-telecine (2:3 pulldown) timing. MPEG-2 (ISO/IEC 13818-2 §6.3.10):
+    /// a field picture occupies 1 field,
     /// a normal frame 2, a `repeat_first_field` progressive-frame 3 (or 4/6 in a
     /// progressive sequence); an rff bit on a non-progressive interlaced frame is
     /// spec-forbidden (§6.3.10) and is treated as 2. Codecs without pulldown

src/mux/codec/crc.rs

@@ -1,16 +1,18 @@
 //! Bit-exact CRC helpers shared by the audio codec decodability gates.
 //!
-//! Both match ffmpeg's `av_crc` tables so a frame that ffmpeg's decoder would
-//! flag as a CRC mismatch is flagged identically here. All are MSB-first
-//! (non-reflected), init 0, no final XOR — the ffmpeg `AV_CRC_*` (big-endian)
-//! variants. Each format transmits its CRC so that the residue over
-//! `data + transmitted_crc` is zero, which is exactly how these are used:
-//! compute over the whole frame (including its trailing CRC) and check `== 0`.
+//! Each matches the CRC defined by its format's bitstream specification, so a
+//! frame these routines flag as a CRC mismatch is exactly the frame a
+//! spec-conformant decoder would reject. All are MSB-first (non-reflected),
+//! init 0, no final XOR — the big-endian CRC variants. Each format transmits
+//! its CRC so that the residue over `data + transmitted_crc` is zero, which is
+//! exactly how these are used: compute over the whole frame (including its
+//! trailing CRC) and check `== 0`.
 
 /// CRC-16/ANSI (a.k.a. CRC-16/BUYPASS): polynomial 0x8005, init 0x0000,
-/// MSB-first, no reflection, no final XOR — ffmpeg `AV_CRC_16_ANSI`.
-/// Used by AC-3/E-AC-3 (frame CRC), FLAC (frame footer), MPEG-audio and
-/// AAC-ADTS (header CRC).
+/// MSB-first, no reflection, no final XOR. Called by the AC-3/E-AC-3 frame-CRC
+/// gate (ETSI TS 102 366) and the FLAC frame footer. (The MPEG-audio and
+/// AAC-ADTS gates validate the header structurally and do not verify their
+/// optional CRC, so they do not call this.)
 pub(crate) fn crc16_ansi(data: &[u8]) -> u16 {
     let mut crc: u16 = 0;
     for &b in data {
@@ -26,14 +28,12 @@ pub(crate) fn crc16_ansi(data: &[u8]) -> u16 {
     crc
 }
 
-/// CRC-16 with polynomial 0x002D, init 0, MSB-first — ffmpeg's `crc_2D` table
-/// (`av_crc_init(crc_2D, 0, 16, 0x002D)`), used by the MLP/TrueHD major-sync
-/// header checksum. NOTE: MLP's checksum is the "reversed" scheme — ffmpeg
-/// computes `av_crc(...) ^ AV_RL16(trailer)` and compares against `AV_RL16` of
-/// the stored word; equivalently, this standard CRC compared against the stored
-/// bytes read big-endian. The caller handles that comparison
-/// (see `truehd::mlp_major_sync_ok`). Verified against real ffmpeg TrueHD
-/// output (225/225 major-sync AUs).
+/// CRC-16 with polynomial 0x002D, init 0, MSB-first, used by the MLP / Dolby
+/// TrueHD major-sync header checksum. NOTE: MLP's checksum is the "reversed"
+/// scheme — the stored trailer word is the little-endian-read CRC, so this
+/// standard CRC must be compared against the stored bytes read big-endian.
+/// The caller handles that comparison (see `truehd::mlp_major_sync_ok`).
+/// Verified against real MLP/TrueHD bitstreams (225/225 major-sync AUs).
 pub(crate) fn crc16_mlp(data: &[u8]) -> u16 {
     let mut crc: u16 = 0;
     for &b in data {
@@ -50,8 +50,8 @@ pub(crate) fn crc16_mlp(data: &[u8]) -> u16 {
 }
 
 /// CRC-8/ATM (a.k.a. CRC-8/ITU without the final XOR): polynomial 0x07, init 0,
-/// MSB-first, no reflection — ffmpeg `AV_CRC_8_ATM`. Used by the FLAC frame
-/// header.
+/// MSB-first, no reflection — the FLAC frame-header CRC-8 (RFC 9639). Available
+/// as a primitive; the FLAC gate currently validates only the frame footer CRC-16.
 pub(crate) fn crc8_atm(data: &[u8]) -> u8 {
     let mut crc: u8 = 0;
     for &b in data {
@@ -90,6 +90,29 @@ mod tests {
         assert_eq!(crc16_ansi(b"123456789"), 0xFEE8);
     }
 
+    #[test]
+    fn crc16_mlp_known_vector_check_bytes() {
+        // Independent known-answer for CRC-16 poly 0x002D, init 0, MSB-first over
+        // the catalogue string "123456789" is 0x4FF7 — computed by a separate
+        // reference implementation (NOT by crc16_mlp), so a wrong polynomial or
+        // shift direction here fails this test even though every truehd fixture
+        // (which derives its trailer from crc16_mlp itself) would still pass.
+        assert_eq!(crc16_mlp(b"123456789"), 0x4FF7);
+        assert_eq!(crc16_mlp(&[0x00, 0x01, 0x02, 0x03]), 0x5E26);
+    }
+
+    #[test]
+    fn crc16_mlp_residue_property_holds() {
+        // Appending the big-endian CRC zeroes the residue over message+crc — the
+        // scheme `truehd::mlp_major_sync_ok` relies on.
+        let msg = [0xF8u8, 0x72, 0x6F, 0xBA];
+        let c = crc16_mlp(&msg);
+        let mut framed = msg.to_vec();
+        framed.push((c >> 8) as u8);
+        framed.push((c & 0xFF) as u8);
+        assert_eq!(crc16_mlp(&framed), 0);
+    }
+
     #[test]
     fn crc8_residue_property_holds() {
         // Appending the CRC-8 of a message zeroes the residue over message+crc —

src/mux/codec/dropgate.rs

@@ -8,8 +8,9 @@
 //! as a decoder-choking glitch.
 //!
 //! The DETECTION is inherently per-codec — each format carries its own
-//! authoritative corruption check (DTS: ffmpeg's core-header parse; AC-3: the
-//! header CRC; FLAC: the frame CRC-16; …). This type only carries the UNIFORM
+//! authoritative corruption check (DTS: the core sync/header parse per ETSI TS
+//! 102 114; AC-3: the header CRC per ETSI TS 102 366; FLAC: the frame CRC-16; …).
+//! This type only carries the UNIFORM
 //! response so every audio parser behaves identically:
 //!
 //! 1. **Count** kept vs dropped AUs and the dropped duration.
@@ -198,4 +199,17 @@ mod tests {
         }
         assert!(!t.is_poisoned());
     }
+
+    #[test]
+    fn collateral_drops_never_poison_the_track() {
+        // A TrueHD resync-forward run collaterally drops a long burst of AUs, but
+        // none are individually undecodable — the whole-track verdict must stay
+        // clean so one corruption event can't amplify into a false total loss.
+        let mut t = DropTally::new("test");
+        for _ in 0..(TRACK_VERDICT_MIN_AUS * 3) {
+            t.record_collateral_drop(0, 1000, 512, "resync-forward");
+        }
+        assert!(t.dropped_frames() >= TRACK_VERDICT_MIN_AUS, "drops counted");
+        assert!(!t.is_poisoned(), "collateral drops must not poison");
+    }
 }

src/mux/codec/dts.rs

@@ -238,7 +238,7 @@ impl CodecParser for DtsParser {
         if pes.data.is_empty() {
             return Vec::new();
         }
-        // A PES with no PTS (rare for audio, but legal — the case OSS demuxers
+        // A PES with no PTS (rare for audio, but legal — the case demuxers
         // guard at a post-gap continuation) must NOT reset the timeline to 0;
         // continue from the most recent known base. Defense-in-depth: the
         // discontinuity-carrying PES is a PUSI with a PTS in practice.
@@ -351,7 +351,16 @@ impl CodecParser for DtsParser {
             let mut forced = false;
             let (au_end, ext_clean) = match next_core_boundary(&self.buf, core_size) {
                 NextCore::Found { end, ext_clean } => (end, ext_clean),
-                NextCore::NeedMore => break, // candidate sync needs more header
+                NextCore::NeedMore if self.buf.len() <= MAX_AU_BYTES => break,
+                NextCore::NeedMore => {
+                    // A candidate boundary exists but is not fully buffered. Normally
+                    // we wait for more PES; but once the buffer exceeds the AU cap,
+                    // apply the same force-flush safety valve as `None` so a crafted
+                    // stream that keeps a boundary perpetually incomplete can't grow
+                    // `buf` without bound (the `break` above never reaches it).
+                    forced = true;
+                    (self.buf.len(), true)
+                }
                 NextCore::None => {
                     // No next core sync buffered yet. The trailing extension
                     // substream PES packets may still be arriving, so WAIT for
@@ -643,8 +652,8 @@ const DTS_CORE_SAMPLE_RATES: [u32; 16] = [
 ];
 
 /// Samples in one DTS core frame: `(NBLKS + 1) * 32`. `NBLKS` (7 bits) is the
-/// core-header PCM-sample-block count — the same field ffmpeg's `dca` decoder
-/// uses to timestamp frames. Bit layout after the 32-bit sync: FTYPE(1) SHORT(5)
+/// core-header PCM-sample-block count (ETSI TS 102 114) that fixes the frame's
+/// decoded sample count. Bit layout after the 32-bit sync: FTYPE(1) SHORT(5)
 /// CPF(1) **NBLKS(7)** FSIZE(14) …, so NBLKS = byte4 bit0 + byte5 bits7-2.
 fn dts_core_samples(data: &[u8]) -> u32 {
     if data.len() < CORE_HEADER_MIN_BYTES {
@@ -673,18 +682,18 @@ fn dts_core_duration_ns(data: &[u8]) -> u64 {
     (samples * 1_000_000_000 + rate / 2) / rate
 }
 
-/// DCA core-header constants, mirrored from ffmpeg `libavcodec/dca_core.h`.
-/// `deficit_samples` must equal this (`DCA_PCMBLOCK_SAMPLES`); `npcmblocks`
-/// must be a multiple of `DCA_SUBBAND_SAMPLES`; `audio_mode` must be below
-/// `DCA_AMODE_COUNT`; `lfe_present == DCA_LFE_FLAG_INVALID` is rejected.
+/// DTS core-header validity constants (ETSI TS 102 114).
+/// `deficit_samples` must equal this (`DTS_PCMBLOCK_SAMPLES`); `npcmblocks`
+/// must be a multiple of `DTS_SUBBAND_SAMPLES`; `audio_mode` must be below
+/// `DTS_AMODE_COUNT`; `lfe_present == DTS_LFE_FLAG_INVALID` is rejected.
 const DTS_PCMBLOCK_SAMPLES: u32 = 32;
 const DTS_SUBBAND_SAMPLES: u32 = 8;
 const DTS_AMODE_COUNT: u32 = 10;
 const DTS_LFE_FLAG_INVALID: u32 = 3;
 
-/// `ff_dca_sample_rates[16]` — sample rate (Hz) per core `SFREQ` code; a `0`
-/// entry marks a reserved code that ffmpeg's parser rejects
-/// (`DCA_PARSE_ERROR_SAMPLE_RATE`). Valid entries are locked to the spec by
+/// Sample rate (Hz) per core `SFREQ` code (ETSI TS 102 114 Table 6-4); a `0`
+/// entry marks a reserved code that fails header validation as an invalid
+/// sample rate. Valid entries are locked to the spec by
 /// `dts_core_sfreq_table_matches_the_dca_spec`; the reserved codes are
 /// {0, 4, 5, 9, 10}.
 const DTS_CORE_SR_VALID: [u32; 16] = [
@@ -692,14 +701,14 @@ const DTS_CORE_SR_VALID: [u32; 16] = [
     192_000,
 ];
 
-/// `ff_dca_bits_per_sample[8]` — a `0` entry marks a reserved `PCMR` code that
-/// ffmpeg's parser rejects (`DCA_PARSE_ERROR_PCM_RES`); reserved codes are
-/// {4, 7}.
+/// Bits per sample per core `PCMR` code (ETSI TS 102 114); a `0` entry marks a
+/// reserved `PCMR` code that fails header validation as an invalid PCM
+/// resolution; reserved codes are {4, 7}.
 const DTS_CORE_PCMR_BITS: [u8; 8] = [16, 16, 20, 20, 0, 24, 24, 0];
 
-/// Why an access unit was judged undecodable. Each core-header variant is the
-/// exact condition under which ffmpeg's `ff_dca_parse_core_frame_header` returns
-/// the matching `DCA_PARSE_ERROR_*`; `TrackPoisoned` is our whole-track drop.
+/// Why an access unit was judged undecodable. Each core-header variant is a
+/// condition under which the DTS core-frame header (ETSI TS 102 114) is invalid
+/// and a decoder would reject the frame; `TrackPoisoned` is our whole-track drop.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum DropReason {
     DeficitSamples,
@@ -730,19 +739,19 @@ impl DropReason {
     }
 }
 
-/// Decodability gate: a faithful port of ffmpeg's `ff_dca_parse_core_frame_header`
-/// validity checks (libavcodec/dca.c). Returns `Some(reason)` when ffmpeg's own
-/// parser would reject this core frame's header — in which case the packet is
-/// undecodable ("Invalid data found") and dropping it loses nothing a decoder
-/// could have used. Returns `None` (keep) for a decodable header OR if the
-/// header can't be fully read (never false-drop on our own buffer underrun; the
-/// framer only emits AUs whose core is fully buffered and ≥ 96 bytes).
+/// Decodability gate: the core-frame header validity checks from ETSI TS 102
+/// 114. Returns `Some(reason)` when the DTS core-frame header is invalid — in
+/// which case the packet is undecodable ("Invalid data found") and dropping it
+/// loses nothing a decoder could have used. Returns `None` (keep) for a
+/// decodable header OR if the header can't be fully read (never false-drop on
+/// our own buffer underrun; the framer only emits AUs whose core is fully
+/// buffered and ≥ 96 bytes).
 ///
 /// The 4-byte core sync is already validated by the framer, so this reads the
-/// header fields that follow it. ffmpeg's parser does NOT verify the CPF header
-/// CRC (it `skip_bits(16)` past it — dca.c) and the core decoder likewise skips
-/// the audio-header/side-info CRCs (dca_core.c), so no CRC check is mirrored
-/// here: doing so would drop frames ffmpeg decodes fine (false positives).
+/// header fields that follow it. The 16-bit CPF header CRC is not verified (we
+/// skip past it) and the audio-header/side-info CRCs are likewise not checked,
+/// because decoders treat those bytes as optional/ignored — verifying them
+/// would drop frames that decode fine (false positives).
 fn core_header_drop_reason(au: &[u8]) -> Option<DropReason> {
     let mut r = BitReader::new(au.get(SYNCWORD_BYTES..)?);
 
@@ -782,7 +791,7 @@ fn core_header_drop_reason(au: &[u8]) -> Option<DropReason> {
     }
     let _predictor_history = r.read_bit()?;
     if crc_present {
-        // ffmpeg only skips the 16-bit header CRC here — it is not verified.
+        // Skip past the 16-bit header CRC here — it is not verified.
         r.skip_bits(16)?;
     }
     let _filter_perfect = r.read_bit()?;
@@ -816,8 +825,8 @@ mod tests {
         let mut data = vec![0u8; size];
         data[0..4].copy_from_slice(&DTS_CORE_SYNC);
         // byte4: FTYPE(0) SHORT(5) CPF(0) NBLKS-high(0). SHORT = 31 makes
-        // deficit_samples = 32 = DCA_PCMBLOCK_SAMPLES, which ffmpeg's parser
-        // (and our decodability gate) require of a real core frame. NBLKS high
+        // deficit_samples = 32 = DTS_PCMBLOCK_SAMPLES, which the decodability
+        // gate (per ETSI TS 102 114) requires of a real core frame. NBLKS high
         // bit (byte4 bit0) stays 0 for NBLKS = 15.
         data[4] = 31u8 << 2;
         // NBLKS = 15 → (15+1)*32 = 512 samples/frame (the DVD/UHD DTS-core norm).
@@ -867,8 +876,8 @@ mod tests {
         // AU = core(512) + a REAL EXSS substream whose XLL payload embeds a DTS
         // core syncword decoding to a plausible size (512). The heuristic-only
         // framer would split here and truncate the lossless extension (the
-        // Dunkirk `dca` "Failed to decode block code(s)" class). Precise EXSS
-        // sizing spans the whole extension to the REAL next core.
+        // Dunkirk "Failed to decode block code(s)" decoder-failure class).
+        // Precise EXSS sizing spans the whole extension to the REAL next core.
         let core = make_dts_core(512);
         let exss = make_exss(600, Some(40));
         let next = make_dts_core(512);
@@ -975,9 +984,9 @@ mod tests {
         // B1: a partial DTS core is buffered, then a concealed gap (PES marked
         // discontinuity) carries a fresh core. The truncated partial must be
         // DROPPED — splicing it makes the framer emit a corrupt sub-core-length
-        // AU (the Dunkirk `dca` "Failed to decode block code(s)" class) and
-        // strands the rest. With the fix the post-gap core is the only AU, and it
-        // carries the post-gap PTS (not the stale pre-gap one).
+        // AU (the Dunkirk "Failed to decode block code(s)" decoder-failure
+        // class) and strands the rest. With the fix the post-gap core is the
+        // only AU, and it carries the post-gap PTS (not the stale pre-gap one).
         let mut parser = DtsParser::new();
 
         // PES 1: first half of a 512-byte core (no boundary marker).
@@ -1124,7 +1133,7 @@ mod tests {
     fn dvd_many_cores_one_pes_are_strictly_monotonic() {
         // Punisher-DVD reproduction: a single PES carrying SEVERAL DTS core
         // frames (the DVD packing) must emit STRICTLY-increasing PTSs. The old
-        // code stamped every AU with the one PES PTS, which ffmpeg rejected as
+        // code stamped every AU with the one PES PTS, which a muxer rejects as
         // "non monotonically increasing dts to muxer: X >= X".
         let mut parser = DtsParser::new();
         let mut stream = Vec::new();
@@ -1171,9 +1180,9 @@ mod tests {
 
     #[test]
     fn dts_core_sfreq_table_matches_the_dca_spec() {
-        // Lock the SFREQ → sample-rate table to ffmpeg's authoritative
-        // `avpriv_dca_sample_rates` (ETSI TS 102 114 Table 6-4). The high-rate
-        // triad in particular — 48 k / 96 k / 192 k at indices 13/14/15 — must not
+        // Lock the SFREQ → sample-rate table to the authoritative values in
+        // ETSI TS 102 114 Table 6-4. The high-rate triad in particular —
+        // 48 k / 96 k / 192 k at indices 13/14/15 — must not
         // be shifted; a wrong entry would compute an N× frame duration and
         // reintroduce PTS drift on a 96/192 kHz DTS stream.
         let mut core = make_dts_core(512);
@@ -1732,8 +1741,8 @@ mod tests {
 
     /// A structurally-framed but UNDECODABLE core: a valid `make_dts_core`
     /// whose reserved header bit is set. It still sizes and syncs correctly (so
-    /// the framer delimits it normally), but ffmpeg's `ff_dca_parse_core_frame_header`
-    /// — and our port — reject it (`DCA_PARSE_ERROR_RESERVED_BIT`). The reserved
+    /// the framer delimits it normally), but the core-frame header validity
+    /// check rejects it as a set reserved bit (ETSI TS 102 114). The reserved
     /// bit is byte9 bit4 in the core header (after SYNC..RATE).
     fn make_bad_dts_core(size: usize) -> Vec<u8> {
         let mut d = make_dts_core(size);
@@ -1753,7 +1762,8 @@ mod tests {
     #[test]
     fn valid_stream_drops_nothing() {
         // A clean stream of decodable cores must pass the gate untouched — the
-        // detector is an exact ffmpeg-parity port, so zero false positives.
+        // detector follows the spec's validity rules exactly, so zero false
+        // positives.
         let mut parser = DtsParser::new();
         let mut stream = Vec::new();
         for _ in 0..5 {
@@ -1859,7 +1869,7 @@ mod tests {
     fn sr_validity_table_marks_reserved_codes() {
         // The core-header sample-rate validity table must have ZERO (reject) at
         // exactly the reserved SFREQ codes {0,4,5,9,10} and a real rate
-        // elsewhere — this is what mirrors ffmpeg's DCA_PARSE_ERROR_SAMPLE_RATE.
+        // elsewhere — this is what drives the invalid-sample-rate rejection.
         for code in 0..16usize {
             let reserved = matches!(code, 0 | 4 | 5 | 9 | 10);
             assert_eq!(
@@ -1872,8 +1882,8 @@ mod tests {
 
     #[test]
     fn every_core_header_error_class_is_detected() {
-        // Exercise each ffmpeg-parity rejection so the port stays faithful.
-        // Start from a decodable core and corrupt one field at a time.
+        // Exercise each header-validity rejection so the gate stays faithful to
+        // the spec. Start from a decodable core and corrupt one field at a time.
         let good = make_dts_core(512);
         assert_eq!(core_header_drop_reason(&good), None);
 
@@ -1913,7 +1923,7 @@ mod tests {
         assert_eq!(core_header_drop_reason(&d), Some(DropReason::LfeFlag));
 
         // pcmr_code reserved (7): pcmr is byte11 bit0 + byte12 bits7-6 → set all
-        // three to 1 (code 7 → ff_dca_bits_per_sample[7] = 0).
+        // three to 1 (code 7 → DTS_CORE_PCMR_BITS[7] = 0, a reserved PCMR code).
         let mut d = good.clone();
         d[11] |= 0x01;
         d[12] |= 0xC0;
@@ -1924,7 +1934,7 @@ mod tests {
     /// through `DtsParser` and writes the emitted access units back out, so the
     /// garbage-extension → core-only drop can be validated against an actual
     /// damaged stream (e.g. the extracted Bourne DTS-HD MA track) end-to-end
-    /// with ffmpeg. Env: `DTS_IN` (input), `DTS_OUT` (output).
+    /// with an external DTS decoder. Env: `DTS_IN` (input), `DTS_OUT` (output).
     ///   cargo test --lib dts::tests::reparse_real_dts_file -- --ignored --nocapture
     #[test]
     #[ignore]

src/mux/codec/flac.rs

@@ -3,10 +3,11 @@
 //! FLAC frames carry no length field, so a raw stream is delimited only by
 //! sync-scanning + CRC validation. In freemkv, though, FLAC never arrives raw:
 //! it comes from mp4/mkv, where each packet is exactly one container-delimited
-//! FLAC frame (the `PARSER_FLAG_COMPLETE_FRAMES` case in ffmpeg). So this parser
+//! FLAC frame (a complete, pre-delimited frame per packet). So this parser
 //! is a per-packet gate, not a framer: every FLAC frame ends with a 16-bit CRC
-//! (poly 0x8005) computed so the residue over the whole frame is zero
-//! (ffmpeg `flac_decode_frame`, `av_crc(AV_CRC_16_ANSI, 0, buf, len) == 0`). A
+//! (poly 0x8005, init 0, non-reflected) computed so the residue over the whole
+//! frame — footer CRC included — is zero (per the FLAC format specification,
+//! RFC 9639, frame footer). A
 //! nonzero residue is definitive corruption → drop the frame (a silence gap,
 //! never a shift — each packet keeps its own PTS), logged via the shared tally.
 //!
@@ -18,17 +19,17 @@ use super::dropgate::DropTally;
 use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 /// FLAC frame sync: 14-bit code `0x3FFE` + a mandatory-0 reserved bit; the next
-/// bit (blocking strategy) is masked off. ffmpeg tests `(AV_RB16 & 0xFFFE) ==
-/// 0xFFF8` (flac_parser.c).
+/// bit (blocking strategy) is masked off. Test the top 15 bits of the first two
+/// bytes: `(be16 & 0xFFFE) == 0xFFF8` (per RFC 9639, frame header).
 fn has_flac_sync(data: &[u8]) -> bool {
     data.len() >= 2 && ((u16::from(data[0]) << 8 | u16::from(data[1])) & 0xFFFE) == 0xFFF8
 }
 
-/// Block-size code → samples, `ff_flac_blocksize_table` (0 = reserved/explicit).
+/// Block-size code → samples (RFC 9639 block-size table; 0 = reserved/explicit).
 const FLAC_BLOCKSIZE_TABLE: [u32; 16] = [
     0, 192, 576, 1152, 2304, 4608, 0, 0, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768,
 ];
-/// Sample-rate code → Hz, `ff_flac_sample_rate_table` (0 = STREAMINFO/explicit).
+/// Sample-rate code → Hz (RFC 9639 sample-rate table; 0 = STREAMINFO/explicit).
 const FLAC_SAMPLE_RATE_TABLE: [u32; 16] = [
     0, 88_200, 176_400, 192_000, 8_000, 16_000, 22_050, 24_000, 32_000, 44_100, 48_000, 96_000, 0,
     0, 0, 0,
@@ -55,6 +56,9 @@ fn flac_frame_duration_ns(frame: &[u8]) -> Option<i64> {
 
 pub struct FlacParser {
     tally: DropTally,
+    /// Last emitted PTS (ns), carried forward across a PES with no PTS rather than
+    /// resetting the timeline to 0 (see the AC-3/DTS parsers) — preserves A/V sync.
+    last_pts_ns: i64,
 }
 
 impl Default for FlacParser {
@@ -67,6 +71,7 @@ impl FlacParser {
     pub fn new() -> Self {
         Self {
             tally: DropTally::new("flac"),
+            last_pts_ns: 0,
         }
     }
 
@@ -86,7 +91,12 @@ impl CodecParser for FlacParser {
         if pes.data.is_empty() {
             return Vec::new();
         }
-        let pts_ns = pes.pts.or(pes.dts).map(pts_to_ns).unwrap_or(0);
+        let pts_ns = pes
+            .pts
+            .or(pes.dts)
+            .map(pts_to_ns)
+            .unwrap_or(self.last_pts_ns);
+        self.last_pts_ns = pts_ns;
 
         // Gate: a packet that begins with a FLAC frame sync but whose whole-frame
         // CRC-16 residue is nonzero is corrupt → drop. Anything else passes

src/mux/codec/hevc.rs

@@ -99,7 +99,8 @@ fn hevc_first_slice_coding_type(nal: &[u8], nal_type: u8, num_extra: u32) -> Opt
 pub struct HevcParser {
     // First-seen parameter set of each type → seeds the MKV codecPrivate (hvcC).
     // This is the ONLY copy the player gets out-of-band, and a player re-applies
-    // it at every keyframe (ffmpeg's hvcC→Annex-B insertion). A stream may
+    // it at every keyframe (the hvcC→Annex-B parameter-set insertion a decoder
+    // performs). A stream may
     // redefine a parameter set mid-title under the SAME id with a different body
     // (some discs redefine PPS id 0 partway through). Any occurrence whose body
     // DIFFERS from this codecPrivate copy must therefore be emitted IN-BAND at
@@ -116,8 +117,9 @@ pub struct HevcParser {
     // set mid-title (e.g. PPS id 0 body changes partway through, then the
     // source STOPS repeating it at later IRAPs and relies on the decoder
     // retaining it), a raw decode is fine — but an hvcC/MKV decode is NOT: a
-    // player re-applies the codecPrivate set at EVERY keyframe (ffmpeg's
-    // hvcC→Annex-B insertion), reverting id 0 to the stale FIRST body. We must
+    // player re-applies the codecPrivate set at EVERY keyframe (the
+    // hvcC→Annex-B parameter-set insertion), reverting id 0 to the stale FIRST
+    // body. We must
     // therefore re-emit the active set IN-BAND at every keyframe whenever it
     // differs from the codecPrivate copy and the access unit didn't already
     // carry it. See `parse`.
@@ -364,9 +366,10 @@ impl HevcParser {
 /// codecPrivate copy (`first`). The two player behaviours for hvcC-in-MKV
 /// diverge exactly here:
 ///
-/// - A *seek-capable / Annex-B* player (e.g. ffmpeg's `hevc_mp4toannexb`)
-///   re-applies the hvcC sets at every keyframe. `reassert_active` handles it.
-/// - A *streaming* decode (ffmpeg decoding the MKV directly — what most
+/// - A *seek-capable / Annex-B* player (one that converts hvcC to Annex-B by
+///   inserting the parameter sets) re-applies the hvcC sets at every keyframe.
+///   `reassert_active` handles it.
+/// - A *streaming* decode (a decoder consuming the MKV directly — what most
 ///   integrity checkers do) applies hvcC ONCE at init and thereafter updates a
 ///   parameter set ONLY from an in-band NAL.
 ///
@@ -427,7 +430,7 @@ fn handle_param_set(
 /// or SPS event), nothing re-sends it and every subsequent slice fails with
 /// "PPS id out of range" until the next genuine change (observed as a ~24 min
 /// corrupt band on one dual-layer UHD title). Re-asserting the active set at
-/// EVERY keyframe — what compliant muxers (mkvmerge) do at every IRAP — makes
+/// EVERY keyframe — what compliant Matroska muxers do at every IRAP — makes
 /// streaming decode self-healing. Re-sending an identical param set is benign
 /// (decoders expect it at IRAPs); cost is a few hundred bytes per keyframe.
 /// This strictly supersets the earlier change-only re-assert, so the

src/mux/codec/mod.rs

@@ -121,11 +121,11 @@ pub trait CodecParser: Send {
 
 /// Passthrough parser — treats each PES as one frame, no parsing.
 ///
-/// Used for the audio codecs that have no dedicated parser and whose PES
-/// boundaries already line up with frame boundaries (Aac, Mp2, Mp3, Flac,
-/// Opus). AC3/DTS/TrueHD have their own parsers; PGS/DvdSub have their own
-/// subtitle parsers. Video codecs must NOT use the all-keyframe form of this
-/// parser — see `parser_for_codec`.
+/// Used for Opus (and any audio codec with no dedicated parser) whose PES
+/// boundaries already line up with frame boundaries. AC3/E-AC3, DTS, TrueHD,
+/// AAC(ADTS), MP2/MP3 and FLAC now have their own gating parsers; PGS/DvdSub
+/// have their own subtitle parsers. Video codecs must NOT use the all-keyframe
+/// form of this parser — see `parser_for_codec`.
 pub struct PassthroughParser {
     keyframe: bool,
 }
@@ -168,8 +168,8 @@ impl CodecParser for PassthroughParser {
 /// - **Audio with independent access units** (DTS, AC-3/E-AC-3, …) gates each AU
 ///   through a per-codec corruption check and drops the ones that fail, keeping
 ///   A/V sync (a drop is a silence gap, never a shift) and logging every drop
-///   via the shared [`dropgate::DropTally`]. DTS uses ffmpeg's core-header parse;
-///   AC-3 uses its native frame CRC.
+///   via the shared [`dropgate::DropTally`]. DTS validates via its core-frame
+///   header (ETSI TS 102 114); AC-3 uses its native frame CRC.
 /// - **LPCM is excluded on purpose**: raw PCM carries no framing or integrity
 ///   data, so a corrupt sample is indistinguishable from a quiet one — there is
 ///   nothing to detect, so nothing can be honestly dropped.
@@ -228,9 +228,9 @@ pub fn parser_for_codec(
             );
             Box::new(PassthroughParser::new(false))
         }
-        // Remaining audio-only codecs (Aac, Mp2, Mp3, Flac, Opus) where PES =
-        // frame: all-keyframe passthrough is correct. Subtitle/Unknown also land
-        // here; keyframe flag is irrelevant for them.
+        // Opus (PES = frame): all-keyframe passthrough is correct. Subtitle/Unknown
+        // also land here; the keyframe flag is irrelevant for them. (Aac/Mp2/Mp3/Flac
+        // have dedicated parsers dispatched earlier in the match.)
         Codec::Opus => Box::new(PassthroughParser::new(true)),
         Codec::Srt | Codec::Ssa | Codec::Unknown(_) => Box::new(PassthroughParser::new(true)),
     }
@@ -285,9 +285,10 @@ mod tests {
     }
 
     #[test]
-    fn unhandled_audio_codecs_use_keyframe_passthrough() {
-        // PES = frame audio codecs: every frame is independently decodable, so
-        // all-keyframe passthrough is correct.
+    fn audio_codecs_emit_keyframe_frames() {
+        // PES = frame audio: every frame is independently decodable → keyframe.
+        // Aac/Mp2/Mp3/Flac go through their dedicated gating parsers (which pass a
+        // non-sync/too-short payload straight through); Opus uses PassthroughParser.
         for codec in [Codec::Aac, Codec::Mp2, Codec::Mp3, Codec::Flac, Codec::Opus] {
             let mut parser = parser_for_codec(codec, None, false);
             let frames = parser.parse(&pes(Some(0), vec![0x01, 0x02]));

src/mux/codec/mpeg2.rs

@@ -483,7 +483,8 @@ fn coding_type_from_raw(raw: u8) -> CodingType {
 
 /// Number of field-display periods a coded picture occupies, from its picture
 /// coding extension (`00 00 01 B5`, ext-id `1000`), per ISO/IEC 13818-2 §6.3.10
-/// and ffmpeg `mpeg_field_start` (`nb_fields = repeat_pict + 2`). This is what
+/// (`nb_fields = repeat_pict + 2`, the field count the spec's repeat rules
+/// yield). This is what
 /// times soft-telecined (2:3 pulldown) DVD video correctly: a
 /// `repeat_first_field` frame occupies 3 fields, a normal frame 2, so honoring
 /// it spreads the ~23.976 coded frames across the 29.97 display span with no

src/mux/codec/mpegaudio.rs

@@ -1,15 +1,18 @@
 //! MPEG-1/2/2.5 audio (MP1/MP2/MP3) decodability gate.
 //!
-//! ffmpeg validates MPEG-audio frames by header sanity + framing resync, not a
-//! payload CRC (`mpegaudiodecheader.c` `ff_mpa_check_header`; the optional CRC
-//! covers only side-info and is off by default). Its `ff_mpa_decode_header`
-//! additionally rejects free-format (`bitrate_index == 0`). So the gate mirrors
-//! exactly those header rejects: a packet that begins with the 11-bit MPEG-audio
-//! sync but whose version / layer / bitrate-index / sample-rate fields are the
-//! reserved/invalid values is undecodable → drop it (a silence gap; each packet
-//! keeps its own PTS). A packet with no leading sync is not a frame we can
-//! validate (raw payload / continuation), so it passes through unchanged —
-//! never false-dropped.
+//! Per ISO/IEC 11172-3 / ISO/IEC 13818-3, an MPEG-audio frame is validated by
+//! header sanity + framing resync, not a payload CRC (the optional 16-bit CRC in
+//! the header protects only the side-information and is absent unless the
+//! protection bit says otherwise). The gate mirrors that header-only check and
+//! ACCEPTS free-format (`bitrate_index == 0`) as a legal decodable mode — it
+//! deliberately does NOT apply the stricter free-format reject that a full
+//! decoder would (see the note at the `bitrate_index` check). So the gate rejects
+//! only the truly invalid headers: a packet that begins with the 11-bit
+//! MPEG-audio sync but whose version / layer / sample-rate fields (or the
+//! reserved bitrate index 15) are reserved/invalid is undecodable → drop it (a
+//! silence gap; each packet keeps its own PTS). A packet with no leading sync is
+//! not a frame we can validate (raw payload / continuation), so it passes through
+//! unchanged — never false-dropped.
 
 use super::dropgate::DropTally;
 use super::{CodecParser, Frame, PesPacket, pts_to_ns};
@@ -20,14 +23,16 @@ enum MpaVerdict {
     NoSync,
     /// Sync present and every field is legal — decodable.
     Valid,
-    /// Sync present but a field is reserved/invalid (or free-format) — ffmpeg's
-    /// parser rejects this exactly.
+    /// Sync present but a field is reserved/invalid — a conformant header parser
+    /// rejects this exactly.
     Invalid,
 }
 
-/// Mirror ffmpeg's `ff_mpa_check_header` + the `ff_mpa_decode_header`
-/// free-format reject. A dropped MPEG-audio frame has a corrupt header, so no
-/// duration is computed (the fields it would come from are the invalid ones).
+/// Header-only validity check per ISO/IEC 11172-3 / ISO/IEC 13818-3 (which
+/// ACCEPTS free-format, `bitrate_index == 0`) — deliberately NOT the stricter
+/// free-format reject a full decoder applies. A dropped MPEG-audio frame has a
+/// corrupt header, so no duration is computed (the fields it would come from are
+/// the invalid ones).
 fn mpa_verdict(data: &[u8]) -> MpaVerdict {
     if data.len() < 4 {
         return MpaVerdict::NoSync;
@@ -37,8 +42,8 @@ fn mpa_verdict(data: &[u8]) -> MpaVerdict {
     if (h & 0xffe0_0000) != 0xffe0_0000 {
         return MpaVerdict::NoSync;
     }
-    // ff_mpa_check_header rejects: version field 01, layer field 00,
-    // bitrate_index 15, sample-rate field 3.
+    // Reject per spec: version field 01, layer field 00, bitrate_index 15,
+    // sample-rate field 3.
     if (h & (3 << 19)) == (1 << 19)
         || (h & (3 << 17)) == 0
         || (h & (0xf << 12)) == (0xf << 12)
@@ -47,14 +52,17 @@ fn mpa_verdict(data: &[u8]) -> MpaVerdict {
         return MpaVerdict::Invalid;
     }
     // NOTE: bitrate_index == 0 (free format) is NOT rejected. It is a legal,
-    // decodable MPEG-audio mode (ffmpeg's ff_mpa_check_header accepts it and the
-    // decoder derives the frame size from the sync spacing). Dropping it would be
-    // a false positive on a clean stream, so it passes the gate.
+    // decodable MPEG-audio mode (the spec permits it and a decoder derives the
+    // frame size from the sync spacing). Dropping it would be a false positive on
+    // a clean stream, so it passes the gate.
     MpaVerdict::Valid
 }
 
 pub struct MpegAudioParser {
     tally: DropTally,
+    /// Last emitted PTS (ns), carried forward across a PES with no PTS rather than
+    /// resetting the timeline to 0 (see the AC-3/DTS parsers) — preserves A/V sync.
+    last_pts_ns: i64,
 }
 
 impl Default for MpegAudioParser {
@@ -67,6 +75,7 @@ impl MpegAudioParser {
     pub fn new() -> Self {
         Self {
             tally: DropTally::new("mpegaudio"),
+            last_pts_ns: 0,
         }
     }
 
@@ -84,7 +93,12 @@ impl CodecParser for MpegAudioParser {
         if pes.data.is_empty() {
             return Vec::new();
         }
-        let pts_ns = pes.pts.or(pes.dts).map(pts_to_ns).unwrap_or(0);
+        let pts_ns = pes
+            .pts
+            .or(pes.dts)
+            .map(pts_to_ns)
+            .unwrap_or(self.last_pts_ns);
+        self.last_pts_ns = pts_ns;
 
         let drop =
             self.tally.is_poisoned() || matches!(mpa_verdict(&pes.data), MpaVerdict::Invalid);
@@ -153,9 +167,21 @@ mod tests {
         assert_eq!(p.dropped_frames(), 0);
     }
 
+    #[test]
+    fn reserved_version_field_is_dropped() {
+        // version field = 01 (reserved) → rejected. byte1 = 111_01_01_1 = 0xEB
+        // keeps the 11-bit sync (0xFF + top 3 bits 111) but sets version bits to 01.
+        let mut p = MpegAudioParser::new();
+        let mut frame = mp3_frame(400);
+        frame[1] = 0xEB;
+        let f = p.parse(&make_pes(frame, Some(90000)));
+        assert!(f.is_empty(), "reserved version dropped");
+        assert_eq!(p.dropped_frames(), 1);
+    }
+
     #[test]
     fn reserved_sample_rate_is_dropped() {
-        // Sync present but sample-rate field = 3 (reserved) → ffmpeg rejects.
+        // Sync present but sample-rate field = 3 (reserved) → rejected per spec.
         // 0xFF 0xFB then byte2 with bits 11..10 = 11: 0x9C.
         let mut p = MpegAudioParser::new();
         let mut frame = mp3_frame(400);

src/mux/codec/truehd.rs

@@ -88,11 +88,11 @@ impl TrueHdParser {
     }
 
     /// Decide whether an access unit is corrupt, updating `num_substreams` from a
-    /// valid major sync. Mirrors ffmpeg `read_access_unit`: a major sync with a
-    /// bad header CRC, or any AU whose header parity fails, is undecodable.
+    /// valid major sync. Per the MLP/TrueHD access-unit decode rules: a major sync
+    /// with a bad header CRC, or any AU whose header parity fails, is undecodable.
     /// Returns `false` (not corrupt) when the AU is too short to judge or no
     /// major sync has established `num_substreams` yet — we never drop what we
-    /// cannot verify. Verified against real ffmpeg TrueHD (3600/3600 AUs).
+    /// cannot verify. Verified against real TrueHD streams (3600/3600 AUs).
     fn au_check(&mut self, au: &[u8], is_major_sync: bool) -> AuCheck {
         let mut header_size = 4;
         let mut format_info = None;
@@ -231,7 +231,7 @@ enum Ac3Size {
     Frame(usize),
 }
 
-// --- MLP/TrueHD access-unit integrity (mirrors ffmpeg mlpdec.c / mlp_parse.c) ---
+// --- MLP/TrueHD access-unit integrity (per the MLP/TrueHD bitstream spec) ---
 
 /// Major-sync header size in bytes: base 28, plus `2 + extensions*2` when the
 /// extension flag (major-sync byte 25, bit 0) is set (`extensions` = byte 26
@@ -251,8 +251,8 @@ fn mlp_major_sync_header_size(ms: &[u8]) -> Option<usize> {
     Some(size)
 }
 
-/// Validate the MLP/TrueHD major-sync header checksum (ffmpeg `ff_mlp_checksum16`,
-/// CRC-16 poly 0x002D). The stored trailer is the last 2 header bytes; because
+/// Validate the MLP/TrueHD major-sync header checksum (a CRC-16 with polynomial
+/// 0x002D). The stored trailer is the last 2 header bytes; because
 /// MLP's checksum is byte-reversed relative to a standard CRC, a standard CRC of
 /// the header body XOR the little-endian word before the trailer must equal the
 /// trailer read big-endian.
@@ -260,14 +260,15 @@ fn mlp_major_sync_crc_ok(ms: &[u8], mshdr: usize) -> bool {
     if mshdr < 4 || ms.len() < mshdr {
         return false;
     }
-    // ffmpeg `ff_mlp_checksum16(buf, buf_size)` (libavcodec/mlp.c):
-    //     av_crc(crc_2D, 0, buf, buf_size - 2) ^ AV_RL16(buf + buf_size - 2)
-    // is called with `buf_size = mshdr - 2` and its result compared to
-    // `AV_RL16(buf + mshdr - 2)` — i.e. the 16-bit checksum over `ms[..mshdr-4]`,
-    // XORed with the LITTLE-ENDIAN word just before the trailer, must equal the
-    // LITTLE-ENDIAN trailer word. `crc16_mlp` is the same crc_2D table (poly 0x2D,
-    // MSB-first) but yields its two bytes in the OPPOSITE order to libavutil's
-    // `av_crc`, so swap them back to match. (The previous code mixed endianness —
+    // The MLP major-sync checksum, `checksum16(buf, buf_size)`, is defined as
+    //     crc16_2D(buf, buf_size - 2) ^ read_le16(buf + buf_size - 2)
+    // evaluated with `buf_size = mshdr - 2` and its result compared to
+    // `read_le16(buf + mshdr - 2)` — i.e. the 16-bit CRC (poly 0x2D, MSB-first)
+    // over `ms[..mshdr-4]`, XORed with the LITTLE-ENDIAN word just before the
+    // trailer, must equal the LITTLE-ENDIAN trailer word. `crc16_mlp` uses that
+    // same poly-0x2D MSB-first table but yields its two bytes in the OPPOSITE
+    // order to a standard little-endian CRC readout, so swap them back to match.
+    // (The previous code mixed endianness —
     // little-endian XOR word but big-endian compare — so the checksum could never
     // validate any real extended major sync, silently dropping the whole track;
     // cross-verified byte-exact against real 7.1/Atmos and 5.1 discs.)
@@ -304,9 +305,8 @@ fn mlp_substr_header_size(au: &[u8], header_size: usize, num_substreams: u8) ->
     Some(shs)
 }
 
-/// MLP/TrueHD AU-header parity check (ffmpeg `ff_mlp_calculate_parity`): the XOR
-/// of the 4-byte AU header with the substream directory, folded, must have its
-/// two nibbles XOR to 0xF.
+/// MLP/TrueHD AU-header parity check: the XOR of the 4-byte AU header with the
+/// substream directory, folded, must have its two nibbles XOR to 0xF.
 fn mlp_parity_ok(au: &[u8], header_size: usize, substr_header_size: usize) -> bool {
     let end = header_size + substr_header_size;
     if end > au.len() {
@@ -560,7 +560,7 @@ impl CodecParser for TrueHdParser {
 }
 
 /// Per-bit channel counts for the TrueHD 8-channel and 6-channel presentation
-/// channel-assignment masks (per the MLP spec / FFmpeg `thd_channels`). Some
+/// channel-assignment masks (per the MLP/TrueHD bitstream spec). Some
 /// bits denote a stereo pair (2), others a single channel (1).
 const THD_8CH: [u8; 13] = [2, 1, 1, 2, 2, 2, 2, 1, 1, 2, 2, 1, 1];
 const THD_6CH: [u8; 5] = [2, 1, 1, 2, 1];
@@ -720,7 +720,7 @@ mod tests {
     /// `format_info` set) into one that passes the decodability gate: 1 substream,
     /// a clean substream directory, a valid major-sync CRC-16, and a valid header
     /// parity nibble. Mirrors what a real encoder writes (verified against real
-    /// ffmpeg TrueHD). The AU must be ≥ 36 bytes (4 AU header + 28 major-sync
+    /// TrueHD streams). The AU must be ≥ 36 bytes (4 AU header + 28 major-sync
     /// header + 2 directory + slack), which every `make_truehd_unit(≥200)` is.
     fn finalize_major_sync(au: &mut [u8]) {
         const MSHDR: usize = 28; // no extension (byte 25 clear)
@@ -729,7 +729,7 @@ mod tests {
         // Substream directory entry at AU[4+MSHDR] = AU[32]: extraword flag clear.
         au[32] &= 0x7F;
         // Major-sync checksum, built EXACTLY as `mlp_major_sync_crc_ok` verifies it
-        // (ffmpeg `ff_mlp_checksum16`): swap_bytes(crc16_mlp(body)) ^ LE word before
+        // (the MLP checksum16): swap_bytes(crc16_mlp(body)) ^ LE word before
         // the trailer, stored little-endian in the trailer.
         let body_end = 4 + MSHDR - 4; // AU[4..28]
         let crc = super::crc16_mlp(&au[4..body_end]).swap_bytes()
@@ -842,7 +842,7 @@ mod tests {
         let mut parser = TrueHdParser::new();
         let ms1 = valid_major_sync();
         let mut bad = valid_normal_au();
-        // A single-nibble flip: MLP's nibble-fold parity (like ffmpeg's) is blind
+        // A single-nibble flip: MLP's nibble-fold parity is blind
         // to a full-byte flip, which changes both nibbles equally and cancels.
         bad[2] ^= 0x01;
         let ms2 = valid_major_sync();
@@ -974,7 +974,7 @@ mod tests {
     #[test]
     fn clean_truehd_stream_drops_nothing() {
         // A run of valid AUs passes untouched — zero false positives (the CRC and
-        // parity are verified against real ffmpeg TrueHD output).
+        // parity are verified against real TrueHD output).
         let mut parser = TrueHdParser::new();
         let mut data = valid_major_sync();
         for _ in 0..5 {
@@ -1297,7 +1297,7 @@ mod tests {
         assert_eq!(truehd_channels_from_stream(&data), Some(8));
     }
 
-    // --- truehd_channels: per-bit mask channel counts (MLP / FFmpeg table) ---
+    // --- truehd_channels: per-bit mask channel counts (MLP channel table) ---
 
     #[test]
     fn truehd_channels_8ch_single_bit_counts() {