Round 5: reject a degenerate fixed lace, bound the pending buffer by bytes

Five fixes. Three are real defects with regression tests; two are bounds
that were expressible but not expressed.

A fixed-size lace (RFC 9559 §10.3.4) whose body is empty declared n
frames and carried none. The divisibility check passed, because 0 % n is
0, and `chunks` yields nothing on an empty slice whatever width it is
given — so the clamp that existed to avoid chunks(0) returned zero frames
where the Lacing Head said n. The whole lace vanished with no error
raised and the caller saw a clean short block. A zero-size frame cannot
be a valid frame, so it is now malformed.

A disc read failure while fetching a directory entry's ICB became a file
size of zero rather than an error. Zero is indistinguishable from a
genuinely empty file, so an unreadable ICB on a damaged disc silently
changed which titles a caller saw as present — read_directory already
fails hard on its entry-budget guard, so propagating is also what the
surrounding code does. read_file_size still returns Ok(0) for an ICB
whose tag is neither File Entry nor Extended File Entry, which is a real
zero and not a failure.

The pending-frame buffer was capped at 4096 frames, which does not bound
memory: frames are arbitrarily large and a UHD video frame runs to a few
hundred KB, so the existing cap permitted over a gigabyte. Now bounded by
bytes as well, at 64 MiB.

round_up_grain overflowed for inputs within one grain of u64::MAX —
div_ceil then multiply — and the wrapped product is small, turning the
largest possible estimate into a negligible reserve. It saturates, and
the reserve is clamped to what a `free` box's 32-bit size field can
actually hold, since writing a larger one truncated the size and left
mdat beyond a box claiming to be far shorter. No real title comes close;
a 90 GB UHD title estimates a few MiB.

The AC-3 resync guard now advances the PTS cadence like both of its
sibling branches, so the three paths out of that block cannot disagree.
This one is defensive and has NO test: reaching it needs input that both
parses frames and leaves a megabyte of residue, and the parser's own
carry rules drop pre-sync junk and cap a partial frame at 8192 bytes, so
no such input was found. Stated here rather than covered by a test that
would pass either way.

Two findings from this round were rejected on inspection. A reported
panic in the .mpls suffix check does not exist: the `.get(..)` on the
line above returns None off a char boundary and `filter` never runs its
closure, so the byte index is unreachable. A test written for it passed
against the unfixed code, which is what surfaced the error.

src/udf.rs

@@ -1098,8 +1098,16 @@ fn read_directory(
                     });
                 }
 
-                // Read the ICB to get file size
-                let file_size = read_file_size(reader, meta_start, icb_lba).unwrap_or(0);
+                // Read the ICB to get file size. A read failure here must
+                // propagate, not become a size of zero: this function already
+                // fails hard on the budget guard above, and a file reported as
+                // zero bytes is indistinguishable from a genuinely empty one, so
+                // an unreadable ICB on a damaged disc would silently change which
+                // titles a caller considers present. `read_file_size` still
+                // returns Ok(0) for an ICB whose tag is neither File Entry (261)
+                // nor Extended File Entry (266), which is a real zero, not a
+                // failure.
+                let file_size = read_file_size(reader, meta_start, icb_lba)?;
 
                 if is_dir && depth < MAX_DIR_DEPTH {
                     // Cycle guard: skip any ICB LBA we have already opened as
@@ -2221,6 +2229,75 @@ mod tests {
         assert_eq!(parse_udf_name(&raw), "BDMV");
     }
 
+    /// A disc read failure while fetching an entry's ICB must propagate, not
+    /// become a file size of zero. A zero size is indistinguishable from a
+    /// genuinely empty file, so an unreadable ICB on a damaged disc silently
+    /// changed which titles a caller saw as present.
+    #[test]
+    fn read_directory_propagates_an_icb_read_failure_instead_of_size_zero() {
+        /// Serves every sector from an inner MemReader except one, which fails
+        /// the way a bad sector does.
+        struct FailingAt {
+            inner: MemReader,
+            fail_lba: u32,
+        }
+        impl SectorSource for FailingAt {
+            fn read_sectors(
+                &mut self,
+                lba: u32,
+                count: u16,
+                buf: &mut [u8],
+                recovery: bool,
+            ) -> Result<usize> {
+                if lba == self.fail_lba {
+                    return Err(Error::DiscRead {
+                        sector: lba as u64,
+                        status: None,
+                        sense: None,
+                    });
+                }
+                self.inner.read_sectors(lba, count, buf, recovery)
+            }
+        }
+
+        // One directory holding one file entry whose ICB lives at LBA 7.
+        let mut dir = [0u8; 2048];
+        let mut name_bytes = vec![8u8];
+        name_bytes.extend_from_slice(b"CLPI");
+        dir[0..2].copy_from_slice(&257u16.to_le_bytes());
+        dir[18] = 0x00; // a file, not a parent, not a dir
+        dir[19] = name_bytes.len() as u8;
+        dir[24..28].copy_from_slice(&7u32.to_le_bytes());
+        dir[38..38 + name_bytes.len()].copy_from_slice(&name_bytes);
+
+        let mut inner = MemReader::new();
+        inner.put(5, build_efe_icb(2048, 2048, 60));
+        inner.put(60, dir);
+        inner.put(7, build_efe_icb(123, 2048, 0));
+
+        // Sanity: with every sector readable the entry parses and carries its
+        // real size, so the failure below is the ICB read and nothing else.
+        let ok = read_directory(&mut inner, 0, 0, 5, "ROOT", 0, &mut 0, &mut HashSet::new())
+            .expect("dir parses when every sector reads");
+        assert_eq!(ok.entries.len(), 1);
+        assert_eq!(ok.entries[0].size, 123);
+
+        let mut reader = FailingAt {
+            inner: MemReader::new(),
+            fail_lba: 7,
+        };
+        reader.inner.put(5, build_efe_icb(2048, 2048, 60));
+        reader.inner.put(60, dir);
+        reader.inner.put(7, build_efe_icb(123, 2048, 0));
+
+        let err = read_directory(&mut reader, 0, 0, 5, "ROOT", 0, &mut 0, &mut HashSet::new())
+            .expect_err("an unreadable entry ICB must fail the scan, not report size 0");
+        assert!(
+            matches!(err, Error::DiscRead { sector: 7, .. }),
+            "the propagated error must name the sector that failed, got {err:?}"
+        );
+    }
+
     #[test]
     fn read_directory_honors_l_iu_offset_for_fid_name() {
         // ECMA-167 §14.4 File Identifier Descriptor: the File Identifier