Bug
QuicPacketBuilderFinalize can reach its final QuicPacketBuilderValidate with Builder->Datagram == NULL but Builder->Metadata->FrameCount != 0, tripping the assert FrameCount == 0 (packet_builder.c:83) and aborting (Debug).
The early-exit block in Finalize only unwinds frame state when Datagram != NULL; when it's entered with Datagram == NULL && FrameCount != 0 (and FlushBatchedDatagrams, TotalCountDatagrams != 0), it goto Exit without resetting FrameCount, then SendBatch + validate fails.
Stack (Debug)
quic_bugcheck packet_builder.c:83 ("Builder->Metadata->FrameCount == 0")
QuicPacketBuilderValidate packet_builder.c:83
QuicPacketBuilderFinalize packet_builder.c:1085
QuicSendFlush send.c:1469
Repro
Debug + ASAN Stress/spinquic (linux, io_uring). Surfaced by SpinQuic settings-randomization coverage (#6204); appears to be a pre-existing core send-path bug, not caused by that PR.
Bug
QuicPacketBuilderFinalizecan reach its finalQuicPacketBuilderValidatewithBuilder->Datagram == NULLbutBuilder->Metadata->FrameCount != 0, tripping the assertFrameCount == 0(packet_builder.c:83) and aborting (Debug).The early-exit block in
Finalizeonly unwinds frame state whenDatagram != NULL; when it's entered withDatagram == NULL && FrameCount != 0(andFlushBatchedDatagrams,TotalCountDatagrams != 0), itgoto Exitwithout resettingFrameCount, thenSendBatch+ validate fails.Stack (Debug)
Repro
Debug + ASAN Stress/spinquic (linux, io_uring). Surfaced by SpinQuic settings-randomization coverage (#6204); appears to be a pre-existing core send-path bug, not caused by that PR.