A torn stream could yield an arbitrary u32 length prefix, turning a re-dial into a multi-GiB allocation attempt. Mirror the service reader: len > MAX_FRAME is InvalidData, so the worker treats it as a dead connection and re-dials instead of OOMing.
A torn stream could yield an arbitrary u32 length prefix, turning a re-dial into a multi-GiB allocation attempt. Mirror the service reader: len > MAX_FRAME is InvalidData, so the worker treats it as a dead connection and re-dials instead of OOMing.