[itlezy]

An untrusted RIFF file can nest LIST chunks until metadata extraction exhausts the stack. Limit traversal to 16 LIST levels and the existing 2 MiB metadata prefix, while continuing to extract valid sibling metadata.

Boundary tests cover accepted and rejected nesting depths, sibling preservation, and nested AVI headers with a truncated trailing list. Scoped ED2K validation passed 1,275 tests on the unchanged behavioral patch before this base refresh; current-head normal commit and push checks passed. Full platform and CodeQL qualification is required on this PR.

Closes #283.

Parent coordination: this existing consolidation lane owns only RIFF metadata extraction and its private regression tests. It runs independently of atomic settings #316, profile ownership #317, packaging #318 and release-guidance work; the parent owns merge order and final-main qualification. The parallel-approved label authorizes these coordinated PRs without changing their required gates.

[itlezy]

Parent-coordinated supersession: qualification runs for this head have been cancelled to prioritize #321, which removes unused Slint/fontconfig APT setup after repeated mirror-DNS failures before Cargo. Source commits and completed evidence are preserved. The parent will refresh this branch onto the actual merged prerequisite and rerun all applicable gates before integration. These deliberate cancellations do not establish a product regression or a passing qualification.