RootCauseunvalidated
comb_tofront(root, i) used an externally-supplied 'root' parameter across all iterations — chain crossed pool boundaries (single-width pool 0x000-0x6FF vs double-width pool 0x700-0x7FF). Tension: This corrupted the LRU linked lists, eventually making combchars[0x800]->prev point to 0x800. Outcome: combchars[0x800]->c2 (the loop upper bound) gets set to a large Unicode codepoint value.
f4feeb59-4f6b-4e6c-a40e-59a26c45f9ae
comb_tofront(root, i) used an externally-supplied 'root' parameter across all iterations — chain crossed pool boundaries (single-width pool 0x000-0x6FF vs double-width pool 0x700-0x7FF). Tension: This corrupted the LRU linked lists, eventually making combchars[0x800]->prev point to 0x800. Outcome: combchars[0x800]->c2 (the loop upper bound) gets set to a large Unicode codepoint value.