fix: 4 more issues from deep audit (argon2id bounds, arithmetic overflow, NaN bypass, unreachable FFI field)

Continuing the audit sweep into cap:ffi, the remaining capability
modules, copy-paste-divergence patterns, and numeric edge cases.

- crypto.zig argon2id: t/m/p validated only lower bounds (unlike
  bcryptHash's cost, bounded both ways) before @intCast-ing them into
  argon2.Params' u32/u32/u24 fields -- an out-of-range value panicked
  that cast immediately, a crash trivially reachable from Gengo source.

- vm.zig .mod opcode: missing the minInt(i64)/-1 overflow guard its
  siblings .int_div/.rem already have (a copy-paste divergence found by
  audit) -- @mod traps/UB's on the same 2^63 overflow. Also fixed
  .int_div's OTHER path (named/decimal-typed operands, reached via
  numericBinaryOp) which silently returned minInt(i64) instead of
  erroring like its plain-int sibling already does.

- cap_net.zig extractHandle/extractUsize/extractI64: NaN compares
  false against every ordinary comparison, so `n < 0 or n > MAX`
  guards silently passed NaN through to @intFromFloat -- the same
  hazard floatToIntSafe (vm.zig) exists to close, reimplemented here
  without that check. Added isFinite guards to all three.

- module_compile.zig: ffi.buf_from_ptr was fully implemented
  (cap_ffi.zig) but permanently unreachable -- missing from the
  compiler's cap:ffi field allowlist, so any script referencing it
  failed to compile at all. Verified fixed via the CLI.

Verified clean under standard, -Dpreset=stress, and -Dgc_stress=true.

Author: ganehag

src/lang/module_compile.zig

@@ -962,12 +962,17 @@ pub fn hasModuleExport(ctx: *anyopaque, path: []const u8, field: []const u8) boo
     const idx = self.findModule(path) orelse {
         // Check capability modules
         const cap_key = if (std.mem.startsWith(u8, path, "cap:")) path[4..] else path;
-        // cap:ffi additionally exports "types" (ffi.types.i32 etc.) and "buf"
-        // (ffi.buf(n)) that are not functions in cm.functions. They are
-        // installed at runtime by installFfiModule in native/main.zig.
+        // cap:ffi additionally exports "types" (ffi.types.i32 etc.), "buf"
+        // (ffi.buf(n)), and "buf_from_ptr" (ffi.buf_from_ptr(ptr, len)) that
+        // are not functions in cm.functions. They are installed at runtime
+        // by installFfiModule in native/main.zig. buf_from_ptr was missing
+        // from this allowlist -- its runtime dispatch (cap_ffi.zig) was
+        // fully implemented but permanently unreachable, since any script
+        // referencing ffi.buf_from_ptr failed to compile at all
+        // (UnknownField) before ever reaching it.
         if (comptime build_options.cap_ffi) {
             if (common.streq(cap_key, "ffi") and
-                (common.streq(field, "types") or common.streq(field, "buf"))) return true;
+                (common.streq(field, "types") or common.streq(field, "buf") or common.streq(field, "buf_from_ptr"))) return true;
         }
         for (self.capability_modules) |cm| {
             if (common.streq(cm.name, cap_key)) {

src/lang/native/cap_net.zig

@@ -27,7 +27,14 @@ fn extractHandle(arg: Value) !u32 {
             break :blk @intCast(n);
         },
         .float => |n| blk: {
-            if (n < 0 or n > @as(f64, @floatFromInt(std.math.maxInt(u32)))) return error.TypeError;
+            // !isFinite catches NaN too, not just checking bounds: NaN
+            // compares false against every ordinary comparison (IEEE 754),
+            // so a bare `n < 0 or n > MAX` guard silently passes NaN
+            // through to @intFromFloat below, which is safety-checked UB
+            // for a non-finite input — the same hazard floatToIntSafe
+            // (vm.zig) exists specifically to close, reimplemented here
+            // without that check.
+            if (!std.math.isFinite(n) or n < 0 or n > @as(f64, @floatFromInt(std.math.maxInt(u32)))) return error.TypeError;
             break :blk @as(u32, @intFromFloat(n));
         },
         else => return error.TypeError,
@@ -41,7 +48,7 @@ fn extractUsize(arg: Value) !usize {
             break :blk @as(usize, @intCast(n));
         },
         .float => |n| blk: {
-            if (n < 0 or n > @as(f64, @floatFromInt(std.math.maxInt(usize)))) return error.TypeError;
+            if (!std.math.isFinite(n) or n < 0 or n > @as(f64, @floatFromInt(std.math.maxInt(usize)))) return error.TypeError;
             break :blk @as(usize, @intFromFloat(n));
         },
         else => return error.TypeError,
@@ -52,7 +59,7 @@ fn extractI64(arg: Value) !i64 {
     return switch (arg) {
         .int => |n| n,
         .float => |n| blk: {
-            if (n < @as(f64, @floatFromInt(std.math.minInt(i64))) or n >= std.math.pow(f64, 2.0, 63.0)) return error.TypeError;
+            if (!std.math.isFinite(n) or n < @as(f64, @floatFromInt(std.math.minInt(i64))) or n >= std.math.pow(f64, 2.0, 63.0)) return error.TypeError;
             break :blk @as(i64, @intFromFloat(n));
         },
         else => return error.TypeError,

src/lang/native/crypto.zig

@@ -453,7 +453,16 @@ fn argon2id(ctx: VMContext, argc: u8) !Value {
     const p = try vms.valueAsInt(ctx.vs.stack[ctx.vs.stack_top - 2]);
     const key_len = try vms.valueAsInt(ctx.vs.stack[ctx.vs.stack_top - 1]);
 
-    if (t < 1 or m < 8 or p < 1 or key_len < 1 or key_len > 64) return error.ValueError;
+    // Upper bounds (not just bcryptHash's lower-bound style) matter here:
+    // t/m/p are cast into std.crypto.pwhash.argon2.Params' u32/u32/u24
+    // fields below with @intCast, and an out-of-range i64 (e.g. m between
+    // u32::max and i64::max) panics that cast immediately -- a crash
+    // trivially reachable from Gengo source, no wire format or policy
+    // misconfiguration needed. The bounds also cap real resource use: m is
+    // in KiB, so 4 GiB and 100 iterations are already generous for any
+    // legitimate password-hashing use, while still comfortably fitting
+    // u32/u32/u24 (max ~4.29e9 / ~4.29e9 / ~1.68e7 respectively).
+    if (t < 1 or t > 100 or m < 8 or m > 4 * 1024 * 1024 or p < 1 or p > 255 or key_len < 1 or key_len > 64) return error.ValueError;
     if (salt.len < 8) return error.ValueError;
 
     // Copy inputs to stack buffers so GC allocation below is safe.

src/lang/vm.zig

@@ -3298,7 +3298,16 @@ fn execOne(ctx: VMContext, comptime op: Op) anyerror!bool {
                     ctx.vs.setRuntimeErr("division by zero", .{});
                     return error.DivisionByZero;
                 }
-                const result: i64 = if (an_int == std.math.minInt(i64) and bn_int == -1) std.math.minInt(i64) else @divTrunc(an_int, bn_int);
+                // This carrier path (named/decimal-wrapped int operands) used
+                // to silently return minInt(i64) here instead of erroring —
+                // a mathematically wrong answer (the true result is 2^63, one
+                // past i64's range), reintroducing the exact bug the plain
+                // int/int path above was already fixed for.
+                if (an_int == std.math.minInt(i64) and bn_int == -1) {
+                    ctx.vs.setRuntimeErr("integer overflow in division", .{});
+                    return error.RangeError;
+                }
+                const result: i64 = @divTrunc(an_int, bn_int);
                 try pushNumericResultWithCarrier(ctx, a, b, @floatFromInt(result), nop.tag, "div");
             },
             .rem => {
@@ -3344,7 +3353,11 @@ fn execOne(ctx: VMContext, comptime op: Op) anyerror!bool {
                         ctx.vs.setRuntimeErr("division by zero", .{});
                         return error.DivisionByZero;
                     }
-                    const result: i64 = @mod(a.int, b.int);
+                    // Same minInt(i64)/-1 overflow as .int_div/.rem just above
+                    // (2^63, one past maxInt) — @mod traps/UB's on it exactly
+                    // like @divTrunc/@rem do, and x mod ±1 is always 0
+                    // mathematically, matching .rem's guard for this case.
+                    const result: i64 = if (a.int == std.math.minInt(i64) and b.int == -1) 0 else @mod(a.int, b.int);
                     try ctx.vs.vmPush(.{ .int = result });
                     continue;
                 }