fix(ntfs): require space for the first attribute marker

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/artifacts/NtfsMftArtifactReader.test.ts

@@ -28,7 +28,8 @@ const recordBytes = (options: {
   record.writeUInt16LE(1, 18);
   record.writeUInt16LE(56, 20);
   record.writeUInt16LE(options.flags ?? 0x0001, 22);
-  record.writeUInt32LE(56, 24);
+  record.writeUInt32LE(64, 24);
+  record.writeUInt32LE(0xffff_ffff, 56);
   record.writeUInt32LE(MFT_DEFAULT_RECORD_BYTES, 28);
   record.writeUInt16LE(sequenceNumber, 510);
   record.writeUInt16LE(sequenceNumber, 1022);

src/domain/windows/ntfsMft.test.ts

@@ -60,7 +60,8 @@ const recordOf = (options: RecordOptions = {}): Uint8Array => {
     Math.ceil((48 + Math.max(0, usaEntries) * 2) / 8) * 8;
   view.setUint16(20, firstAttributeOffset, true);
   view.setUint16(22, options.flags ?? 0x0001, true);
-  view.setUint32(24, firstAttributeOffset, true);
+  view.setUint32(24, firstAttributeOffset + 8, true);
+  view.setUint32(firstAttributeOffset, 0xffff_ffff, true);
   view.setUint32(28, recordBytes, true);
   view.setBigUint64(32, options.baseRecordReference ?? 0n, true);
   view.setUint16(40, 0, true);
@@ -123,7 +124,7 @@ describe("MFT header facts", () => {
     });
   });
 
-  it.each([0, 49, 64])(
+  it.each([0, 49, 64, 72])(
     "reports an invalid first attribute offset %i",
     (offset) => {
       const record = recordOf();

src/domain/windows/ntfsMft.ts

@@ -381,7 +381,7 @@ const readRecord = (
       usedBytes <= totalBytes &&
       firstAttributeOffset % 8 === 0 &&
       firstAttributeOffset >= NTFS_MFT_MIN_RECORD_BYTES &&
-      firstAttributeOffset <= usedBytes &&
+      firstAttributeOffset + 4 <= usedBytes &&
       (fixups.malformed ||
         firstAttributeOffset >= usaOffset + fixups.entries * 2),
     baseRecordReference:

tests/boundary/mcp/ntfsMftAdmission.test.ts

@@ -47,7 +47,9 @@ mcpTest(
     record.writeUInt16LE(42, 4);
     record.writeUInt16LE(3, 6);
     record.writeUInt16LE(1, 16);
-    record.writeUInt32LE(56, 24);
+    record.writeUInt16LE(56, 20);
+    record.writeUInt32LE(64, 24);
+    record.writeUInt32LE(0xffff_ffff, 56);
     record.writeUInt32LE(1024, 28);
     record.writeUInt16LE(5, 42);
     record.writeUInt16LE(5, 510);