Fix all PES pipeline audit findings (20 issues)

Critical:
- C1: PES serialize validates track < 256 and data < 4GB
- C2: PES deserialize caps frame size at 256MB (OOM protection)
- C3: TsMuxer stuffing uses static buffer, no per-packet alloc
- C4: PES length uses unbounded (0x0000) for audio >65535 bytes
- C6: TsDemuxer validates AF length <= 183

Warning:
- W1: parse_timestamp validates marker bits, returns Option
- W2: PES header data_start clamped to data.len()
- W3: TsMuxer PTS conversion uses saturating_mul, rejects negative
- W4: AC3/DTS replace debug_assert with runtime bounds check
- W6: MKV block_vint handles 3-4 byte VINTs
- W7: meta.rs to_title() uses unwrap_or fallbacks instead of panic
- W8: MKV reader skips frames for non-existent tracks
- W9: DVD PTS uses higher-precision conversion (1e9/90000)
- FMKV read_header caps JSON at 10MB
- PAT section_len underflow guard

Suggestion:
- S2: TsMuxer uses static STUFF_FF buffer
- S3: HEVC parser single-pass NAL scan (was duplicated)
- S4: TsDemuxer caps remainder at one packet
- S5: PTS 90kHz→ns uses round-to-nearest

src/mux/codec/ac3.rs

@@ -99,7 +99,9 @@ fn find_ac3_sync(data: &[u8]) -> Option<usize> {
 /// bsid is at byte 5, bits 7..3.
 /// AC-3: bsid <= 10, E-AC-3: bsid >= 11 (typically 16).
 pub fn get_bsid(data: &[u8]) -> u8 {
-    debug_assert!(data.len() >= 6);
+    if data.len() < 6 {
+        return 0;
+    }
     (data[5] >> 3) & 0x1F
 }
 
@@ -107,7 +109,9 @@ pub fn get_bsid(data: &[u8]) -> u8 {
 /// frmsiz is at bits [2:0] of byte 2 concatenated with byte 3.
 /// Frame size = (frmsiz + 1) * 2 bytes.
 pub fn eac3_frame_size(data: &[u8]) -> usize {
-    debug_assert!(data.len() >= 4);
+    if data.len() < 4 {
+        return 0;
+    }
     let frmsiz = ((data[2] as usize & 0x07) << 8) | (data[3] as usize);
     (frmsiz + 1) * 2
 }

src/mux/codec/dts.rs

@@ -82,7 +82,9 @@ pub fn find_dts_hd_ext_sync(data: &[u8]) -> Option<usize> {
 /// The size field is at bytes 6-8 of the extension:
 ///   ((ext[6] & 0x1F) << 11) | (ext[7] << 3) | (ext[8] >> 5) + 1
 pub fn dts_hd_ext_frame_size(ext: &[u8]) -> usize {
-    debug_assert!(ext.len() >= 9);
+    if ext.len() < 9 {
+        return 0;
+    }
     let raw =
         ((ext[6] as usize & 0x1F) << 11) | ((ext[7] as usize) << 3) | ((ext[8] as usize) >> 5);
     raw + 1

src/mux/codec/h264.rs

@@ -180,6 +180,9 @@ pub fn find_start_code(data: &[u8], from: usize) -> Option<usize> {
     if data.len() < from + 3 {
         return None;
     }
+    // Range excludes last 2 bytes since we read 3 bytes at each position.
+    // data.len()-2 as exclusive upper bound means last checked index is data.len()-3,
+    // which accesses data[len-3], data[len-2], data[len-1] — all valid.
     (from..data.len() - 2).find(|&i| data[i] == 0x00 && data[i + 1] == 0x00 && data[i + 2] == 0x01)
 }
 

src/mux/codec/hevc.rs

@@ -52,8 +52,9 @@ impl CodecParser for HevcParser {
         let pts_ns = pes.dts.or(pes.pts).map(pts_to_ns).unwrap_or(0);
         let data = &pes.data;
         let mut keyframe = false;
+        let mut frame_data = Vec::new();
 
-        // Scan NAL units
+        // Single-pass NAL scan: extract params, detect keyframes, build length-prefixed output
         let mut pos = 0;
         while let Some(sc_pos) = find_start_code(data, pos) {
             if let Some(nal_start) = skip_start_code(data, sc_pos) {
@@ -68,45 +69,22 @@ impl CodecParser for HevcParser {
                     let nal_type = (data[nal_start] >> 1) & 0x3F;
 
                     match nal_type {
-                        NAL_VPS => self.vps = Some(data[nal_start..end].to_vec()),
-                        NAL_SPS => self.sps = Some(data[nal_start..end].to_vec()),
-                        NAL_PPS => self.pps = Some(data[nal_start..end].to_vec()),
+                        NAL_VPS => { self.vps = Some(data[nal_start..end].to_vec()); }
+                        NAL_SPS => { self.sps = Some(data[nal_start..end].to_vec()); }
+                        NAL_PPS => { self.pps = Some(data[nal_start..end].to_vec()); }
+                        NAL_AUD => {} // Skip access unit delimiters
                         t if (NAL_BLA_W_LP..=NAL_RSV_IRAP_VCL23).contains(&t) => {
                             keyframe = true;
+                            let nal = &data[nal_start..end];
+                            frame_data.extend_from_slice(&(nal.len() as u32).to_be_bytes());
+                            frame_data.extend_from_slice(nal);
+                        }
+                        _ => {
+                            // All other NAL types (slices, SEI, DV RPU, etc.) pass through
+                            let nal = &data[nal_start..end];
+                            frame_data.extend_from_slice(&(nal.len() as u32).to_be_bytes());
+                            frame_data.extend_from_slice(nal);
                         }
-                        _ => {}
-                    }
-                }
-                pos = next;
-            } else {
-                break;
-            }
-        }
-
-        // Convert Annex B to length-prefixed NALUs.
-        // Skip VPS/SPS/PPS/AUD — they're in codecPrivate.
-        let mut frame_data = Vec::new();
-        let mut pos = 0;
-        while let Some(sc_pos) = find_start_code(&pes.data, pos) {
-            if let Some(nal_start) = skip_start_code(&pes.data, sc_pos) {
-                let next = find_start_code(&pes.data, nal_start).unwrap_or(pes.data.len());
-                let mut end = next;
-                while end > nal_start && pes.data[end - 1] == 0x00 {
-                    end -= 1;
-                }
-
-                if nal_start < pes.data.len() {
-                    let nal_type = (pes.data[nal_start] >> 1) & 0x3F;
-                    // Skip parameter sets and AUD
-                    if nal_type != NAL_VPS
-                        && nal_type != NAL_SPS
-                        && nal_type != NAL_PPS
-                        && nal_type != NAL_AUD
-                    {
-                        let nal = &pes.data[nal_start..end];
-                        let len = nal.len() as u32;
-                        frame_data.extend_from_slice(&len.to_be_bytes());
-                        frame_data.extend_from_slice(nal);
                     }
                 }
                 pos = next;

src/mux/codec/mod.rs

@@ -31,9 +31,11 @@ pub struct Frame {
     pub data: Vec<u8>,
 }
 
-/// Convert 90kHz PTS to nanoseconds.
+/// Convert 90kHz PTS to nanoseconds (round to nearest).
 pub fn pts_to_ns(pts: i64) -> i64 {
-    pts * 100_000 / 9
+    // pts * 1_000_000_000 / 90_000 = pts * 100_000 / 9
+    // Add half-divisor for rounding: (pts * 100_000 + 4) / 9
+    (pts * 100_000 + 4) / 9
 }
 
 /// Trait for codec-specific elementary stream parsers.