[hatoo]

QUIC receive streams accepted offsets beyond advertised per-stream credit. Connection-limit checks ran after buffering and completion events, and RESET final sizes spent no connection credit. With an 8-byte window, a 9-byte STREAM was accepted; a RESET from offset 4 to final size 8 left connection accounting at 4.

Validate stream/connection limits and final sizes before state mutation or payload copying, account RESET high-water increases exactly once, and send the appropriate transport close. Keep CRYPTO reassembly independent of stream credit. An unsent MAX_DATA grant now becomes effective only when it fits into a packet, while lost grants preserve their retransmission semantics. Existing fully retired-stream handling is unchanged.

Validation:

• Three baseline regressions fail before the fix; 16 new Rust tests cover boundary/overflow, no buffer growth, reordering/duplicates, RESET, reuse, grants/loss, and authentication.
• Debug and release each pass 535 unit and 63 integration tests (2 pre-existing ignored), including independent Quinn credit recovery. Strict all-target Clippy and formatting pass.
• 12 new encrypted aioquic cases verify exact request/error/status accounting and close codes 3/6/7; added to required CI. Existing 41 QPACK status and 12 send-accounting cases also pass.
• Actual-source 64 KiB rejected-payload probe: in-order allocation 65,536→0 bytes, reordered 65,664→0 bytes. Valid 8-byte control unchanged. This is component allocation evidence.

This is a correctness/resource repair, with no throughput-improvement claim. Fixed-hfast serial/multiplexed guards completed 27,131,904 requests including warmups with zero unexpected errors. Three alternating pairs plus reversed-order confirmation observed serial RPS +1.183%/-1.861%, multiplexed RPS -2.455%/-2.010%, and multiplexed client CPU/request +1.739%/+0.893%. The small observed cost and WSL2 uncertainty are documented in benchmarks/quic-receive-limits.md; all latency/error accounting remains enabled.