BUG: StringDType UTF-8 decoder may read out of bounds #32288

import numpy as np
from numpy.dtypes import StringDType

# Element 0: 15 ASCII bytes + 0xF0 (truncated 4-byte UTF-8 lead)
# = 16 bytes total, stored in arena (> 15 byte short string limit on 64-bit)
#
# Element 1: 144 bytes (0x90 size byte in arena), starts with 0x80 0x80
#
# OOB read from \xF0: picks up arena size byte 0x90 + data bytes 0x80, 0x80
# Decodes as: U+10000 (valid codepoint, from leaked adjacent data)

x = np.array([
    b'A' * 15 + b'\xF0',               # 16 bytes after NUL trim, in arena
    b'\x80\x80' + b'A' * 142,           # 144 bytes, starts with 0x80 0x80
], dtype='S144')

s = x.astype(StringDType())
u = s.astype('U16')
print(repr(u[0]), [hex(ord(ch)) for ch in u[0]])