AIKIDO-2026-676591

TL;DR

zerovec's blanket ULE implementation for fixed-size arrays checks that the byte buffer holds a whole number of T elements but not that the buffer length is a multiple of the array's own byte size. A [T; N] zero-copy value built from an externally supplied byte buffer whose length matches T but not [T; N] passes validation despite the size mismatch, so later unsafe casting code computes an element count from a length relationship it never checked. Zero-sized arrays pass the same check unconditionally, since their element size is zero, regardless of buffer length. The fix rejects zero-length arrays and requires the buffer length to be an exact multiple of the array's size.