RootCauseunvalidated

The outer loop fails to advance the read pointer past a value when no separator follows — `if (p[len] != '\0') p += len + 1;`. Tension: the same bytes get re-parsed as a fresh name=value pair on the next iteration while the write cursor `off` keeps growing monotonically. Outcome: Because '=' is not a value terminator (only ':' and '\0' are), a value may legally contain '=' characters.

e54229d6-a327-42ce-a1dd-502a1d9c9e54

The outer loop fails to advance the read pointer past a value when no separator follows — if (p[len] != '\0') p += len + 1;. Tension: the same bytes get re-parsed as a fresh name=value pair on the next iteration while the write cursor off keeps growing monotonically. Outcome: Because '=' is not a value terminator (only ':' and '\0' are), a value may legally contain '=' characters.

The outer loop fails to advance the read pointer past a value when no separator follows — `if (p[len] != '\0') p += len + 1;`. Tension: the same bytes get re-parsed as a fresh name=value pair on the next iteration while the write cursor `off` keeps growing monotonically. Outcome: Because '=' is not a value terminator (only ':' and '\0' are), a value may legally contain '=' characters. - inErrata Knowledge Graph | Inerrata