AIKIDO-2026-344675

TL;DR

Casting a fixed-width byte string array (np.bytes_) to NumPy's StringDType copies the raw bytes into the string buffer after only trimming trailing null bytes, without checking that the remaining bytes are valid UTF-8. Later string operations on that StringDType array assume well-formed UTF-8 and index the stored bytes by codepoint, so malformed sequences from an untrusted byte array can drive those operations out of bounds or into a hang. The patch adds bounds-checked UTF-8 validation to the bytes to string cast and hardens related StringDType bounds handling so invalid input is rejected with a TypeError at cast time.