[lawrencecchen]

Summary

The tip panic ratchet is red: cmux-wg-tun: clippy::indexing_slicing 4 > new crate (must be 0) (fleet job e3cabfe8f3a4526406d20a58). cmux-wg-tun came in lawrencecchen's direct push ad2c76731f28..cc33e089376e (commits b4f6d32 and d2b1b1c).

Neither #34198 (the revert, which keeps the Rust crate) nor #34204 (the extension forward fix) changes this crate, so this PR fixes the red alone. It does not depend on either of them.

The four indexes now read with get(), with no allow:

• utun.rs interface_name: the name takes the whole buffer when the kernel reports a longer length (as the old min() did) and ends at its first NUL.
• engine.rs drain_tun: a packet range outside the frame buffer, or an empty one, skips that packet.
• engine.rs drain_socket: a datagram length outside its buffer stops the burst instead of panicking.

Behavior inside the bounds is unchanged.

Changelog

none

Testing

• python3 scripts/cmux-next/prepush-gate.py: no new violations.
• Fleet, macOS: cmux-tui-rust-check.sh test engine::tests::, step f74200465feb95b217cf67d8, green. It ran all 6 cmux-wg-tun tests (engine::tests::*) among 35 matched. 5 passed in the full run. a_socketpair_is_not_mistaken_for_utun failed in the full run and passed alone (nextest FLAKY). That test calls only interface_name, whose result this PR leaves unchanged for every in-bounds length, so the flake is in the crate from the push and not from this change; the crate owner must fix it. An earlier step a809c4f688e9 used the filter cmux_wg_tun, which selected 0 tests (exit 4) and proved nothing.
• Fleet, Linux: panic ratchet cmux-tui-rust-check.sh panic, step 16044e3cf8c0c17c9078de52. Result in a comment.

Observed / Not run

• Observed: the prepush gate; fleet results in the comment.
• Not run: a live tunnel.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the clippy::indexing_slicing panic ratchet violation in cmux-wg-tun by replacing direct slice indexing with get() reads, so the new crate meets the required zero-violation budget.

• The utun interface name now takes the whole buffer when the kernel reports a longer length and ends at its first NUL.
• Packet ranges or datagram lengths outside their buffer now skip that read instead of panicking.
• Behavior inside the buffer bounds is unchanged.

^{Written for commit 6277862. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 6277862: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34220 -f ref=base-red-wg-tun-panic -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4173568006501 (cb6b71feab)
• cmux NEXT nightly 1.0.0-nightly.4173689456801 (4c71330ed9)
• cmux NEXT nightly 1.0.0-nightly.4173805520001 (cf0fddef88)

[lawrencecchen]

Review (claude-opus-reviewer): SHIP at 6277862

Independent review (read-only). By reading, it compiles: the borrows are disjoint fields, Default holds for &[u8], and as_slice works on the array. Behavior inside the bounds is unchanged: the utun name equals the old min() and position() result, and an empty packet is still skipped. The only index expressions left are constant indexes into fixed arrays (fds[0..2]), which clippy does not lint. The PR adds no allow attribute and no other deny-lint site.

[lawrencecchen]

Panic ratchet at the head 6277862: fleet step 16044e3cf8c0c17c9078de52 (hq run 41712271411).

• cmux-wg-tun is at 0 indexing_slicing at the head. The only cmux-wg-tun lines are warnings, not RED: cmux-wg-tun: clippy::arithmetic_side_effects 1 > new crate (must be 0) and cmux-wg-tun: clippy::cast_possible_truncation 3 > new crate (must be 0).
• The RED lines are base reds and are not in files this PR touches: acpmux: clippy::indexing_slicing 688 > baseline 686 and cmux-tui: clippy::indexing_slicing 835 > baseline 831. The tip b8cf524 has the same reds (acpmux 688 > 686), and the BASE RED TIP owner is working on them.

macOS tests: step f74200465feb95b217cf67d8 is green with all 6 cmux-wg-tun tests (one FLAKY: a_socketpair_is_not_mistaken_for_utun failed in the full run and passed alone; see the body). The SHIP receipt for this head is above.