A record offset was only checked against the page's end, so one pointing into the page header/offset table, or back into an already-parsed record, would read those bytes as a fabricated cookie. Offsets must now land past the offset table and records may not overlap any accepted so far.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>