Harden memory layer: fix char sizing, ref structs, count guards, ReadString advance

Second-review fixes, each covered by a regression test in MemoryHardeningTests:

- MarshalCache: special-case char (Size=2; Marshal.SizeOf reports 1/ANSI but the
  blittable path reads a 2-byte UTF-16 unit). TypeRequiresMarshal now also trips on
  RuntimeHelpers.IsReferenceOrContainsReferences<T>() so reference-carrying structs
  route to the marshal path instead of throwing in MemoryMarshal.Read. Document that
  the MarshalAs scan is top-level only.
- MemoryBase.Read<T>(count): reject negative count (ArgumentOutOfRangeException) and
  guard elementSize*count overflow. Same overflow guard on Write<T>(values).
- MemoryBase.ReadString: advance by bytes actually read, not the requested amount, so
  a partial read no longer skips the unread tail of the window.
- ExternalReader: default to a minimal access set (not AllAccess, which over-requests
  and fails on protected processes); wrap Process.MainModule in try/catch so a
  bitness-mismatched or protected target yields ImageBase=Zero instead of throwing.
- NativeMethods: WaitForSingleObject and CreateRemoteThread's threadId are DWORD (uint),
  not int — the signatures no longer sign-flip.

Deferred: hoisting the identical ExternalReader/InProcessReader byte-IO into MemoryBase
(cosmetic; skipped to avoid colliding with concurrent Phase 3 edits).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

WhiteMagicTest/MemoryHardeningTests.cs

@@ -0,0 +1,189 @@
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Text;
+using WhiteMagic;
+using WhiteMagic.Native;
+
+namespace WhiteMagicTest;
+
+/// <summary>
+/// Regression tests for the edge-case defects found in the second review pass:
+/// char sizing, reference-containing structs, unchecked counts, the ReadString
+/// partial-chunk skip, and ExternalReader construction against awkward targets.
+/// Each test fails against the pre-fix code.
+/// </summary>
+public class MemoryHardeningTests
+{
+    private static ExternalReader OpenSelf()
+    {
+        return new ExternalReader(
+            Process.GetCurrentProcess(),
+            ProcessAccess.VmRead | ProcessAccess.VmWrite | ProcessAccess.VmOperation | ProcessAccess.QueryInformation);
+    }
+
+    // ── char sizing (MarshalCache / MemoryBase.Read<char>) ──────────────────
+
+    [Fact]
+    public void MarshalCache_char_size_is_two_bytes()
+    {
+        Assert.Equal(2, MarshalCache<char>.Size);
+    }
+
+    [Fact]
+    public void Read_char_writes_and_reads_back()
+    {
+        using var reader = OpenSelf();
+        char slot = '\0';
+        GCHandle pin = GCHandle.Alloc(slot, GCHandleType.Pinned);
+        try
+        {
+            IntPtr addr = pin.AddrOfPinnedObject();
+            Assert.True(reader.Write(addr, 'Z'));
+            Assert.Equal('Z', reader.Read<char>(addr));
+        }
+        finally
+        {
+            pin.Free();
+        }
+    }
+
+    [Fact]
+    public void Read_char_array_writes_and_reads_back()
+    {
+        using var reader = OpenSelf();
+        char[] slot = new char[4];
+        GCHandle pin = GCHandle.Alloc(slot, GCHandleType.Pinned);
+        try
+        {
+            IntPtr addr = pin.AddrOfPinnedObject();
+            char[] expected = ['w', 'o', 'w', '!'];
+            Assert.True(reader.Write(addr, expected));
+            Assert.Equal(expected, reader.Read<char>(addr, 4));
+        }
+        finally
+        {
+            pin.Free();
+        }
+    }
+
+    // ── reference-containing structs route to the marshal path ──────────────
+
+    [Fact]
+    public void MarshalCache_flags_struct_with_reference_field_as_marshal_required()
+    {
+        // Has a string field but no [MarshalAs]; the blittable path (MemoryMarshal.Read)
+        // throws for a reference-containing T, so the cache must route it to the marshal
+        // path. A struct with a managed reference cannot be pinned, so the routing flag —
+        // not a live round-trip — is the regression guard here.
+        Assert.True(MarshalCache<StructWithReference>.TypeRequiresMarshal);
+    }
+
+    // ── unchecked count guards ──────────────────────────────────────────────
+
+    [Fact]
+    public void Read_array_with_negative_count_throws_argument_out_of_range()
+    {
+        using var reader = OpenSelf();
+        int dummy = 0;
+        GCHandle pin = GCHandle.Alloc(dummy, GCHandleType.Pinned);
+        try
+        {
+            Assert.Throws<ArgumentOutOfRangeException>(() => reader.Read<int>(pin.AddrOfPinnedObject(), -1));
+        }
+        finally
+        {
+            pin.Free();
+        }
+    }
+
+    [Fact]
+    public void Read_array_with_zero_count_returns_empty()
+    {
+        using var reader = OpenSelf();
+        int dummy = 0;
+        GCHandle pin = GCHandle.Alloc(dummy, GCHandleType.Pinned);
+        try
+        {
+            Assert.Empty(reader.Read<int>(pin.AddrOfPinnedObject(), 0));
+        }
+        finally
+        {
+            pin.Free();
+        }
+    }
+
+    // ── ReadString partial-chunk advance ────────────────────────────────────
+
+    [Fact]
+    public void ReadString_advances_by_actual_bytes_when_reads_are_partial()
+    {
+        // The reader serves at most 3 bytes per call. The string is longer than one
+        // chunk with the terminator well past it. If ReadString advanced by the
+        // requested count instead of the bytes actually returned, it would skip
+        // data and truncate the result.
+        byte[] data = Encoding.ASCII.GetBytes("ABCDEFGHIJ\0");
+        var reader = new PartialReader(data, maxChunk: 3);
+
+        string result = reader.ReadString(IntPtr.Zero, Encoding.ASCII, maxLength: 64);
+
+        Assert.Equal("ABCDEFGHIJ", result);
+    }
+
+    [Fact]
+    public void ReadString_stops_at_null_across_partial_chunks()
+    {
+        byte[] data = Encoding.ASCII.GetBytes("hi\0garbage");
+        var reader = new PartialReader(data, maxChunk: 1);
+
+        string result = reader.ReadString(IntPtr.Zero, Encoding.ASCII, maxLength: 64);
+
+        Assert.Equal("hi", result);
+    }
+
+    // ── ExternalReader construction ─────────────────────────────────────────
+
+    [Fact]
+    public void ExternalReader_opens_self_with_default_access()
+    {
+        // The default access set must be small enough to open a normal process.
+        using var reader = new ExternalReader(Process.GetCurrentProcess());
+        Assert.False(reader.Handle.IsInvalid);
+    }
+
+    /// <summary>
+    /// A <see cref="MemoryBase"/> that serves bytes from an in-memory buffer and
+    /// caps every read to <c>maxChunk</c> bytes, to exercise partial-read handling.
+    /// The address is treated as a zero-based index into the buffer.
+    /// </summary>
+    private sealed class PartialReader(byte[] data, int maxChunk) : MemoryBase
+    {
+        public override IntPtr ImageBase => IntPtr.Zero;
+        public override SafeMemoryHandle Handle => null!;
+
+        public override byte[] ReadBytes(IntPtr address, int count, bool isRelative = false)
+        {
+            int start = (int)address;
+            if (start < 0 || start >= data.Length || count <= 0)
+                return [];
+            int n = Math.Min(Math.Min(count, maxChunk), data.Length - start);
+            return data[start..(start + n)];
+        }
+
+        public override int WriteBytes(IntPtr address, ReadOnlySpan<byte> bytes, bool isRelative = false)
+            => throw new NotSupportedException();
+
+        public override void Dispose() { }
+    }
+}
+
+/// <summary>
+/// A struct that carries a managed reference. <see cref="RuntimeHelpers.IsReferenceOrContainsReferences{T}"/>
+/// reports <see langword="true"/>, so it cannot travel the blittable read path.
+/// </summary>
+[StructLayout(LayoutKind.Sequential)]
+public struct StructWithReference
+{
+    public int Id;
+    public string Name;
+}