AIKIDO-2026-920940

TL;DR

The DSF (DSD Stream File) parser skips unrecognized chunks using an asynchronous tokenizer call that is not awaited. When a chunk reports a size smaller than its own header length, the parser attempts to skip a negative number of bytes, causing the underlying tokenizer to throw a RangeError. Because the skip call is detached from the promise chain, the rejection surfaces as an unhandled promise rejection that terminates the Node.js process even when the caller wraps parsing in try/catch. The fix validates chunk and metadata-pointer sizes and awaits the skip call so malformed input is rejected as a catchable error.