AIKIDO-2026-319534

TL;DR

The BroCatli concatenator in src/concat/mod.rs only recognizes a Brotli sub-stream's header as complete once exactly 4 or 5 bytes have been buffered. A short, complete empty sub-stream that terminates before that point never satisfies the check, so BroCatli::stream keeps reporting NeedsMoreInput and stalls indefinitely even though the concatenated input has already ended. This lets malformed or truncated concatenated Brotli input hang stream processing instead of completing or returning an error. The fix also recognizes the window, ISLAST, and ISLASTEMPTY bits as soon as they are buffered, so short empty streams are detected without waiting for bytes that never arrive.