* bug #1: don't allow for values out of the SerializationRecordType enum range

* bug #2: throw SerializationException rather than KeyNotFoundException when the referenced record is missing or it points to a record of different type

* bug #3: throw SerializationException rather than FormatException when it's being thrown by BinaryReader (or sth else that we use)

* bug #4: document the fact that IOException can be thrown

* bug #5: throw SerializationException rather than OverflowException when parsing the decimal fails

* bug #6: 0 and 17 are illegal values for PrimitiveType enum

* bug #7: throw SerializationException when a surrogate character is read (so far an ArgumentException was thrown)

* [NRBF] Don't use Unsafe.As when decoding DateTime(s) (dotnet#105749)

* Add NrbfDecoder Fuzzer (dotnet#107385)

* [NRBF] Fix bugs discovered by the fuzzer (dotnet#107368)

* bug #1: don't allow for values out of the SerializationRecordType enum range

* bug #2: throw SerializationException rather than KeyNotFoundException when the referenced record is missing or it points to a record of different type

* bug #3: throw SerializationException rather than FormatException when it's being thrown by BinaryReader (or sth else that we use)

* bug #4: document the fact that IOException can be thrown

* bug #5: throw SerializationException rather than OverflowException when parsing the decimal fails

* bug #6: 0 and 17 are illegal values for PrimitiveType enum

* bug #7: throw SerializationException when a surrogate character is read (so far an ArgumentException was thrown)
# Conflicts:
#	src/libraries/System.Formats.Nrbf/src/System/Formats/Nrbf/NrbfDecoder.cs

* [NRBF] throw SerializationException when a surrogate character is read (dotnet#107532)

 (so far an ArgumentException was thrown)

* [NRBF] Fuzzing non-seekable stream input (dotnet#107605)

* [NRBF] More bug fixes (dotnet#107682)

- Don't use `Debug.Fail` not followed by an exception (it may cause problems for apps deployed in Debug)
- avoid Int32 overflow
- throw for unexpected enum values just in case parsing has not rejected them
- validate the number of chars read by BinaryReader.ReadChars
- pass serialization record id to ex message
- return false rather than throw EndOfStreamException when provided Stream has not enough data
- don't restore the position in finally 
- limit max SZ and MD array length to Array.MaxLength, stop using LinkedList<T> as List<T> will be able to hold all elements now
- remove internal enum values that were always illegal, but needed to be handled everywhere
- Fix DebuggerDisplay

* [NRBF] Comments and bug fixes from internal code review (dotnet#107735)

* copy comments and asserts from Levis internal code review

* apply Levis suggestion: don't store Array.MaxLength as a const, as it may change in the future

* add missing and fix some of the existing comments

* first bug fix: SerializationRecord.TypeNameMatches should throw ArgumentNullException for null Type argument

* second bug fix: SerializationRecord.TypeNameMatches should know the difference between SZArray and single-dimension, non-zero offset arrays (example: int[] and int[*])

* third bug fix: don't cast bytes to booleans

* fourth bug fix: don't cast bytes to DateTimes

* add one test case that I've forgot in previous PR
# Conflicts:
#	src/libraries/System.Formats.Nrbf/src/System/Formats/Nrbf/SerializationRecord.cs

* [NRBF] Address issues discovered by Threat Model  (dotnet#106629)

* introduce ArrayRecord.FlattenedLength

* do not include invalid Type or Assembly names in the exception messages, as it's most likely corrupted/tampered/malicious data and could be used as a vector of attack.

* It is possible to have binary array records have an element type of array without being marked as jagged

---------

Co-authored-by: Buyaa Namnan <bunamnan@microsoft.com>

Build Analysis matches on either ErrorMessage (literal String.Contains)
or ErrorPattern (regex), but populating both is undefined behavior — the
parser may use only one and the caller cannot predict which. The current
skeleton encouraged filling ErrorMessage with the test name and
ErrorPattern with the regex, producing the worst of both worlds: the
test-name substring matches every [PASS] line for that test on every
future run, muting legitimate regressions.

Replace the single skeleton with two alternative skeletons — one for
literal-substring match, one for regex — and require the agent to pick
exactly one field per JSON block and delete the other. Strengthen check
#6 to forbid bare test names in ErrorPattern regexes too, not just in
ErrorMessage literals.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Two fixes driven by the first scanner run on this branch:

- Step 4.4 (existing test-disable PR dedup): also search the test-name
  stem after stripping verb prefixes and platform suffixes. PR titles
  often abbreviate (e.g. DnsGetHostEntry_X -> X). Without the fallback,
  the scanner filed dotnet#128442 as a duplicate of dotnet#128425.

- KBE check #6 and bad-vs-good table: reject array-form signatures whose
  second element is a generic xunit assertion stem ('Assert.Equal()
  Failure: Values differ', 'Assert.True() Failure', etc). Require the
  unique 'Expected:'/'Actual:' value lines or the actual exception type
  + message. dotnet#128444 (now closed) emitted such a weak signature; Build
  Analysis would have mismatched it against unrelated failures.

Lock file: re-applies the manual pat_pool patch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>