Fix bounds, memory protection, and completion race in core helpers

- AllocatedMemory.Read<T>/Write<T>/ReadBytes/WriteBytes now validate that
  the requested byte range stays within the allocated block before calling
  into the memory accessor.
- Patch.Apply/Remove temporarily changes the target page to read-write and
  restores the original protection, mirroring the Detour behavior.
- MainThreadPump.WorkItem uses TrySetResult/TrySetException and swallows the
  InvalidOperationException raised when a completion source is already
  completed, preventing Dispose from failing during concurrent pump drainage.

Regression tests added for all three fixes.

Tests: 206 passing, 4 skipped.

WhiteMagic/Execution/MainThreadPump.cs

@@ -83,7 +83,7 @@ public sealed class MainThreadPump : IDisposable
                 throw new InvalidOperationException("The main-thread pump is not installed. Call Install() first.");
 
             object? Box() => work()!;
-            _queue.Enqueue(new WorkItem(Box, r => tcs.SetResult((TResult)r!), ex => tcs.SetException(ex)));
+            _queue.Enqueue(new WorkItem(Box, r => tcs.TrySetResult((TResult)r!), ex => tcs.TrySetException(ex)));
         }
 
         return tcs.Task;
@@ -158,20 +158,34 @@ public sealed class MainThreadPump : IDisposable
         public WorkItem(Func<object?> work, TaskCompletionSource<object?> tcs)
         {
             Work = work;
-            _setResult = r => tcs.SetResult(r);
-            _setException = ex => tcs.SetException(ex);
+            _setResult = r => tcs.TrySetResult(r);
+            _setException = ex => tcs.TrySetException(ex);
         }
 
         public Func<object?> Work { get; }
 
         public void SetResult(object? result)
         {
-            _setResult?.Invoke(result);
+            try
+            {
+                _setResult?.Invoke(result);
+            }
+            catch (InvalidOperationException)
+            {
+                // Already completed, e.g. concurrent Dispose/PumpHook race.
+            }
         }
 
         public void SetException(Exception exception)
         {
-            _setException?.Invoke(exception);
+            try
+            {
+                _setException?.Invoke(exception);
+            }
+            catch (InvalidOperationException)
+            {
+                // Already completed, e.g. concurrent Dispose/PumpHook race.
+            }
         }
     }
 }

WhiteMagic/Hooking/Patch.cs

@@ -1,5 +1,7 @@
 using System;
 using System.Linq;
+using System.Runtime.InteropServices;
+using WhiteMagic.Native;
 
 namespace WhiteMagic.Hooking;
 
@@ -53,7 +55,31 @@ public sealed class Patch : IDisposable
             return;
 
         OriginalBytes = _memory.ReadBytes(Address, PatchBytes.Length);
-        _memory.WriteBytes(Address, PatchBytes);
+
+        if (!NativeMethods.VirtualProtectEx(
+            _memory.Handle,
+            Address,
+            PatchBytes.Length,
+            MemoryProtectionType.ExecuteReadWrite,
+            out MemoryProtectionType oldProtect))
+        {
+            int error = Marshal.GetLastPInvokeError();
+            throw new InvalidOperationException($"Failed to change target memory protection: error {error}");
+        }
+
+        try
+        {
+            _memory.WriteBytes(Address, PatchBytes);
+        }
+        finally
+        {
+            NativeMethods.VirtualProtectEx(
+                _memory.Handle,
+                Address,
+                PatchBytes.Length,
+                oldProtect,
+                out _);
+        }
     }
 
     /// <summary>Restores the original bytes if they were captured.</summary>
@@ -62,7 +88,31 @@ public sealed class Patch : IDisposable
         if (OriginalBytes is null)
             return;
 
-        _memory.WriteBytes(Address, OriginalBytes);
+        if (!NativeMethods.VirtualProtectEx(
+            _memory.Handle,
+            Address,
+            OriginalBytes.Length,
+            MemoryProtectionType.ExecuteReadWrite,
+            out MemoryProtectionType oldProtect))
+        {
+            int error = Marshal.GetLastPInvokeError();
+            throw new InvalidOperationException($"Failed to change target memory protection: error {error}");
+        }
+
+        try
+        {
+            _memory.WriteBytes(Address, OriginalBytes);
+        }
+        finally
+        {
+            NativeMethods.VirtualProtectEx(
+                _memory.Handle,
+                Address,
+                OriginalBytes.Length,
+                oldProtect,
+                out _);
+        }
+
         OriginalBytes = null;
     }
 

WhiteMagic/Memory/AllocatedMemory.cs

@@ -86,12 +86,18 @@ public sealed class AllocatedMemory : IDisposable
     public IntPtr AddressOf(string name)
     {
         ObjectDisposedException.ThrowIf(_disposed, this);
+        int offset = GetRegionOffset(name);
+        return _baseAddress + offset;
+    }
+
+    private int GetRegionOffset(string name)
+    {
         ArgumentNullException.ThrowIfNull(name);
 
         if (!_regions.TryGetValue(name, out int offset))
             throw new ArgumentException($"Region '{name}' does not exist.", nameof(name));
 
-        return _baseAddress + offset;
+        return offset;
     }
 
     /// <summary>
@@ -105,8 +111,12 @@ public sealed class AllocatedMemory : IDisposable
     {
         ObjectDisposedException.ThrowIf(_disposed, this);
 
-        IntPtr address = AddressOf(name);
-        return _memory.Read<T>(address);
+        int offset = GetRegionOffset(name);
+        int size = Marshal.SizeOf<T>();
+        if (offset > _size - size)
+            throw new ArgumentOutOfRangeException(nameof(name), $"Region '{name}' read of {size} bytes exceeds allocation size {_size}.");
+
+        return _memory.Read<T>(_baseAddress + offset);
     }
 
     /// <summary>
@@ -121,8 +131,12 @@ public sealed class AllocatedMemory : IDisposable
     {
         ObjectDisposedException.ThrowIf(_disposed, this);
 
-        IntPtr address = AddressOf(name);
-        return _memory.Write(address, value);
+        int offset = GetRegionOffset(name);
+        int size = Marshal.SizeOf<T>();
+        if (offset > _size - size)
+            throw new ArgumentOutOfRangeException(nameof(name), $"Region '{name}' write of {size} bytes exceeds allocation size {_size}.");
+
+        return _memory.Write(_baseAddress + offset, value);
     }
 
     /// <summary>
@@ -136,8 +150,12 @@ public sealed class AllocatedMemory : IDisposable
     {
         ObjectDisposedException.ThrowIf(_disposed, this);
 
-        IntPtr address = AddressOf(name);
-        return _memory.ReadBytes(address, count);
+        int offset = GetRegionOffset(name);
+        ArgumentOutOfRangeException.ThrowIfNegative(count);
+        if (offset > _size - count)
+            throw new ArgumentOutOfRangeException(nameof(count), $"Region '{name}' read of {count} bytes exceeds allocation size {_size}.");
+
+        return _memory.ReadBytes(_baseAddress + offset, count);
     }
 
     /// <summary>
@@ -151,8 +169,11 @@ public sealed class AllocatedMemory : IDisposable
     {
         ObjectDisposedException.ThrowIf(_disposed, this);
 
-        IntPtr address = AddressOf(name);
-        return _memory.WriteBytes(address, bytes);
+        int offset = GetRegionOffset(name);
+        if (offset > _size - bytes.Length)
+            throw new ArgumentOutOfRangeException(nameof(bytes), $"Region '{name}' write of {bytes.Length} bytes exceeds allocation size {_size}.");
+
+        return _memory.WriteBytes(_baseAddress + offset, bytes);
     }
 
     /// <summary>