Fix bounds, memory protection, and completion race in core helpers

- AllocatedMemory.Read<T>/Write<T>/ReadBytes/WriteBytes now validate that
  the requested byte range stays within the allocated block before calling
  into the memory accessor.
- Patch.Apply/Remove temporarily changes the target page to read-write and
  restores the original protection, mirroring the Detour behavior.
- MainThreadPump.WorkItem uses TrySetResult/TrySetException and swallows the
  InvalidOperationException raised when a completion source is already
  completed, preventing Dispose from failing during concurrent pump drainage.

Regression tests added for all three fixes.

Tests: 206 passing, 4 skipped.

WhiteMagicTest/Hooking/HookingTests.cs

@@ -91,6 +91,46 @@ public class HookingTests
         }
     }
 
+    [Fact]
+    public void Patch_apply_on_execute_only_memory_succeeds()
+    {
+        using var reader = CreateReader();
+
+        byte[] code = [0xB8, 0x2A, 0x00, 0x00, 0x00, 0xC3]; // mov eax, 42; ret
+        IntPtr alloc = NativeMethods.VirtualAllocEx(
+            reader.Handle,
+            IntPtr.Zero,
+            code.Length,
+            MemoryAllocationType.Commit | MemoryAllocationType.Reserve,
+            MemoryProtectionType.ExecuteReadWrite);
+        Assert.NotEqual(IntPtr.Zero, alloc);
+
+        try
+        {
+            reader.WriteBytes(alloc, code);
+
+            // Remove write access. Without VirtualProtectEx in Patch.Apply,
+            // applying a patch would fail because the page is read-only for writes.
+            Assert.True(NativeMethods.VirtualProtectEx(
+                reader.Handle,
+                alloc,
+                code.Length,
+                MemoryProtectionType.ExecuteRead,
+                out MemoryProtectionType _));
+
+            Patch patch = reader.PatchManager.Create("nop-ret", alloc, [0x90, 0x90]);
+            patch.Apply();
+            Assert.True(patch.IsApplied);
+
+            patch.Remove();
+            Assert.False(patch.IsApplied);
+        }
+        finally
+        {
+            NativeMethods.VirtualFreeEx(reader.Handle, alloc, 0, MemoryFreeType.Release);
+        }
+    }
+
     [Fact]
     public void Detour_apply_redirects_callOriginal_remove_restores()
     {
@@ -335,4 +375,55 @@ public class HookingTests
             NativeMethods.VirtualFreeEx(reader.Handle, allocation, 0, MemoryFreeType.Release);
         }
     }
+
+    [Fact]
+    public async Task MainThreadPump_concurrent_dispose_and_pump_does_not_throw()
+    {
+        using var reader = CreateReader();
+
+        IntPtr targetPtr = AllocateFrameStub(reader, out IntPtr allocation);
+        try
+        {
+            var pump = new WhiteMagic.Execution.MainThreadPump(reader.DetourManager, targetPtr);
+            pump.Install();
+
+            FrameFunc routed = Marshal.GetDelegateForFunctionPointer<FrameFunc>(targetPtr);
+
+            var tasks = new List<Task<int>>();
+            for (int i = 0; i < 50; i++)
+            {
+                int value = i;
+                tasks.Add(pump.ExecuteAsync(() => value));
+            }
+
+            // Drive the detoured frame while disposing from another thread.
+            // This stresses the race between PumpHook completing work and
+            // Dispose faulting still-queued work.
+            Task drive = Task.Run(() =>
+            {
+                for (int i = 0; i < 10; i++)
+                {
+                    try { routed(); } catch { }
+                }
+            });
+
+            await Task.Delay(10);
+            pump.Dispose();
+            await drive;
+
+            // Any faulted task must have been cancelled by Dispose; no
+            // unhandled exceptions should escape from the pump itself.
+            foreach (Task<int> task in tasks)
+            {
+                if (task.IsFaulted)
+                {
+                    Assert.IsType<ObjectDisposedException>(task.Exception!.InnerException);
+                }
+            }
+        }
+        finally
+        {
+            NativeMethods.VirtualFreeEx(reader.Handle, allocation, 0, MemoryFreeType.Release);
+        }
+    }
 }

WhiteMagicTest/Memory/AllocatedMemoryTests.cs

@@ -251,4 +251,73 @@ public class AllocatedMemoryTests
 
         Assert.Contains("does not exist", ex.Message);
     }
+
+    [Fact]
+    public void Read_T_throws_when_value_exceeds_allocation()
+    {
+        using var reader = CreateReader();
+
+        using var allocated = new AllocatedMemory(reader, 100);
+        allocated.AddRegion("boundary", 99);
+
+        var ex = Assert.Throws<ArgumentOutOfRangeException>(() =>
+            allocated.Read<int>("boundary"));
+
+        Assert.Equal("name", ex.ParamName);
+    }
+
+    [Fact]
+    public void Write_T_throws_when_value_exceeds_allocation()
+    {
+        using var reader = CreateReader();
+
+        using var allocated = new AllocatedMemory(reader, 100);
+        allocated.AddRegion("boundary", 99);
+
+        var ex = Assert.Throws<ArgumentOutOfRangeException>(() =>
+            allocated.Write("boundary", 42));
+
+        Assert.Equal("name", ex.ParamName);
+    }
+
+    [Fact]
+    public void ReadBytes_throws_when_count_exceeds_allocation()
+    {
+        using var reader = CreateReader();
+
+        using var allocated = new AllocatedMemory(reader, 100);
+        allocated.AddRegion("boundary", 99);
+
+        var ex = Assert.Throws<ArgumentOutOfRangeException>(() =>
+            allocated.ReadBytes("boundary", 2));
+
+        Assert.Equal("count", ex.ParamName);
+    }
+
+    [Fact]
+    public void WriteBytes_throws_when_span_exceeds_allocation()
+    {
+        using var reader = CreateReader();
+
+        using var allocated = new AllocatedMemory(reader, 100);
+        allocated.AddRegion("boundary", 99);
+
+        var ex = Assert.Throws<ArgumentOutOfRangeException>(() =>
+            allocated.WriteBytes("boundary", new byte[2]));
+
+        Assert.Equal("bytes", ex.ParamName);
+    }
+
+    [Fact]
+    public void Read_and_Write_at_exact_allocation_boundary_succeed()
+    {
+        using var reader = CreateReader();
+
+        using var allocated = new AllocatedMemory(reader, 100);
+        allocated.AddRegion("boundary", 96);
+
+        const int expected = unchecked((int)0xDEADBEEF);
+        Assert.True(allocated.Write("boundary", expected));
+        Assert.Equal(expected, allocated.Read<int>("boundary"));
+    }
 }