@@ -78,7 +78,7 @@ implementation ticket.
 | [SR-AUD-064](modules/core/include/System/Lazy.hpp.audit.md#sr-aud-064--medium--lazy-constructors-silently-accept-an-invalid-thread-safety-mode) | medium | confirmed | `Lazy.hpp` | Mode-taking constructors retain invalid `LazyThreadSafetyMode` values and access dispatches them as PublicationOnly instead of throwing an argument-range error. |
 | [SR-AUD-065](modules/core/include/System/Lazy.hpp.audit.md#sr-aud-065--medium--lazy-accepts-an-empty-factory-and-defers-failure-to-stdbad_function_call) | medium | remediated | `Lazy.hpp` | Empty `std::function` factories are accepted then fail at first `Value` with native `std::bad_function_call`, rather than deterministic constructor validation. |
 | [SR-AUD-066](modules/core/include/System/Lazy.hpp.audit.md#sr-aud-066--medium--publicationonly-wrongly-rejects-recursive-value-access) | medium | confirmed | `Lazy.hpp` | An unconditional reentrancy guard throws for PublicationOnly even though .NET reserves this recursive-Value exception for None and ExecutionAndPublication. |
-| [SR-AUD-067](modules/core/include/System/Buffer.hpp.audit.md#sr-aud-067--high--raw-bufferblockcopy-converts-negative-metadata-into-an-unbounded-memmove) | high | confirmed | `Buffer.hpp` | Raw-pointer BlockCopy accepts negative offsets/count; negative count casts to `size_t` and reaches ASan-confirmed unbounded `memmove` instead of deterministic argument validation. |
+| [SR-AUD-067](modules/core/include/System/Buffer.hpp.audit.md#sr-aud-067--high--raw-bufferblockcopy-converts-negative-metadata-into-an-unbounded-memmove) | high | remediated | `Buffer.hpp` | Raw-pointer BlockCopy accepts negative offsets/count; negative count casts to `size_t` and reaches ASan-confirmed unbounded `memmove` instead of deterministic argument validation. |
 | [SR-AUD-068](modules/core/include/System/ValueType.hpp.audit.md#sr-aud-068--medium--valuetype-is-publicly-constructible-and-defaults-to-identity-rather-than-net-value-semantics) | medium | confirmed | `ValueType.hpp`, `ValueTypeTests.cpp` | Public C++ `ValueType` is constructible and uses identity/address defaults, where .NET has an abstract fieldwise-value base; direct tests lock in the divergent fallback. |
 | [SR-AUD-069](modules/core/include/System/SequencePosition.hpp.audit.md#sr-aud-069--medium--sequenceposition-exposes-mutable-public-representation-instead-of-an-opaque-readonly-position) | medium | confirmed | `SequencePosition.hpp`, `Batch6BuffersTests.cpp` | Public mutable `void*`/integer components let callers rewrite a returned position, unlike .NET's private readonly opaque representation; tests never protect that boundary. |
 | [SR-AUD-070](modules/buffers/include/System/Buffers/ArrayBufferWriter.hpp.audit.md#sr-aud-070--medium--arraybufferwritert-silently-requires-a-default-constructible-t) | medium | remediated | `ArrayBufferWriter.hpp`, `MemoryPool.hpp` | Vector resize and `Clear` impose an undocumented default-constructor requirement on `T`; a valid non-default-constructible type fails to compile at `GetSpan`, and MemoryPool repeats the constraint.  **Remediated (#2054, 2026-08-04, family B-C, `docs/BuffersNamespaceReviewPlan.md` §4.4/§23.4):** each requirement is now stated in the owning type's Doxygen block and `static_assert`ed **at the point where it was already enforced**, so *exactly the same set of programs compiles* and only the diagnostic changes — measured site by site against the pre-change headers materialised from `b294738`. **Two premise corrections.** (a) The site count is **six**, not two: the review already promoted `ArrayBufferWriter::checkAndResizeBuffer`, `::Clear`, `MemoryPoolHeapOwner_`'s constructor and `SharedArrayPool<T>::Rent` + `ArrayPool<T>::Return(clearArray=true)` to first-class sites, and implementation found the sixth, `ArrayBufferWriter(intcs initialCapacity)`, which resizes on its own. `SequenceReader<T>::TryRead`/`TryPeek` are two further `T{}` sites whose requirement was **already documented** (the CCF-014 contract); they gain the assert but were never silent. (b) "fails to compile at `GetSpan`" understates where it bites: `GetSpan`/`GetMemory` are `virtual` overrides and `ArrayPool`'s `Rent`/`Return` are `virtual`, so their bodies are instantiated **for the vtable** — measured, `ArrayBufferWriter<NoDefault> w;` and `ArrayPool<NoDefault>::Shared().Return(v, false)` were already rejected before this ticket. Naming the type and `sizeof` stay legal for any `T`, which is why no assert is at class scope. Copy-assignability, which `Clear` and `Return(…, true)` also require, was undocumented too and is now asserted. 13 negative consumer sites (`test/consumer/buffers_generic_requirements_negative.cpp`) prove the rejected half; 9 tests in `BuffersGenericRequirementsTests.cpp` pin the accepted half. No runtime code, signature, layout, vtable or `noexcept` specification changed. |
 
@@ -65,3 +65,65 @@ Checked primitive-vector paths are materially improved, but the raw public
 overload remains ASan-unsafe for negative metadata and generic vector templates
 permit nontrivial lifetime corruption. No source or test was modified during
 this audit.
+
+---
+
+## SR-AUD-067 — REMEDIATED (ticket #2212, 2026-08-10, family CMS-A)
+
+The original evidence above is retained unchanged. **Only SR-AUD-067 is closed by this
+ticket**; the SR-AUD-051 extension recorded in this same report stays `confirmed` and is
+closed separately by ticket #2213. **No `SR-AUD-*` identifier was created**; numbering
+stays frozen at 364. Family record: `docs/CoreMemorySafetyFamilyPlan.md`.
+
+The raw-pointer `BlockCopy` now runs
+`ArgumentOutOfRangeException::ThrowIfNegative` on `srcOffset`, then `dstOffset`, then
+`count`, **before any pointer arithmetic** — the same helper, the same order and the same
+exception as the sibling `std::vector` overload's `requireValidBlockCopyRange`, and the
+same order .NET's `Buffer.BlockCopy` uses before its internal `Memmove`. The upper-bound
+limitation the header documents is unchanged: a raw pointer still carries no capacity, and
+that is still the caller's responsibility.
+
+**Premise correction — the finding is three doors, not one, and the defect class is not
+the predicted one.** The audit demonstrated `count = -1` and asserted that negative offsets
+"similarly form invalid pointers". Measured under AddressSanitizer on 2026-08-10
+(`build-probe/2210_before.log`), all three are separately reproducible and they are **not
+the same class**:
+
+| Argument | Before | After |
+|---|---|---|
+| `count = -1` | **stack-buffer-overflow** in `memmove` (`Buffer.hpp:59`) | `ArgumentOutOfRangeException` `(Parameter 'count')` |
+| `srcOffset = -4` | **stack-buffer-underflow** in `memmove` | `ArgumentOutOfRangeException` `(Parameter 'srcOffset')` |
+| `dstOffset = -4` | **stack-buffer-overflow** in `memmove` | `ArgumentOutOfRangeException` `(Parameter 'dstOffset')` |
+
+The audit predicted `negative-size-param`. It is not what this toolchain reports: GCC 13.3
+at `-O1` with `_FORTIFY_SOURCE` inlines `__memmove_chk`, so libsanitizer's `memmove`
+interceptor — the code that emits `negative-size-param` — is bypassed and ASan's ordinary
+shadow check fires instead. The compiler additionally emits `-Wstringop-overflow=` and
+`-Wstringop-overread` naming `Buffer.hpp:59` for all three. After-log:
+`build-probe/2212_after.log`; the deliberate `heap-buffer-overflow` control still reports
+in the same binary, so the absence is an absence and not a dead instrumentation.
+
+**Closure evidence.** 8 permanent regressions in
+`modules/core/tests/System/CoreMemorySafetyTests.cpp`: each of the three arguments rejected;
+the exact `paramName` **and** the srcOffset → dstOffset → count order; a negative offset
+rejected **even when `count == 0`** (the case the old code silently got away with, because
+`memmove` of zero bytes never touched the bad pointer); `INTCS_MIN`; no destination byte
+written by a rejected call; every valid copy, `count == 0`, and the overlapping
+`memmove` unchanged; and catchability as `System::Exception`.
+`SharpRuntimeTests_Core_Base` **5,600/5,600** (1 pre-existing skip); `BufferTests` and
+`Batch13BufferTests` unchanged and green. Whole repository builds with zero errors and zero
+warnings.
+
+**Five mutations, five killed — four of them by assertion.** M1 delete the `srcOffset`
+guard → 3 fail. M2 delete the `dstOffset` guard → 3 fail. M3 reorder the three guards →
+the order test fails. M4 `ThrowIfNegative(count - 1)` (over-rejects a legal `count == 0`)
+→ the valid-call test fails. **M0, deleting all three guards at once, is reported
+separately and honestly: it kills by process abort, not by assertion**, because a negative
+`count` reaches `memmove` and crashes the runner — that abort *is* the pre-fix defect, so
+it is real but it is a weaker signal, which is exactly why the zero-count rejection tests
+were added to give M1 and M2 an assertion-level kill.
+
+**Source, ABI and layout consequences: none.** Three statements added to one inline static
+member of a stateless class (`Buffer() = delete`, no data members). No signature, no
+`noexcept` specification, no virtual function, no default argument and no mangled symbol
+changed.
@@ -48,14 +48,32 @@ namespace System {
          * length-aware System::Collections::ObjectSpan destination, so it is no longer an
          * example of an accepted limitation.
          *
+         * @note The capacity of a raw buffer cannot be discovered, but that does not make
+         * every argument unverifiable. A negative @p count used to be cast straight to
+         * @c size_t and a negative offset used to form a pointer *before* its own buffer;
+         * all three were AddressSanitizer-confirmed out-of-bounds `memmove` operations
+         * (SR-AUD-067: `count < 0` a **stack-buffer-overflow**, `srcOffset < 0` a
+         * **stack-buffer-underflow**, `dstOffset < 0` a **stack-buffer-overflow**). Each
+         * is now rejected deterministically before any pointer arithmetic, in the same
+         * order and with the same exception as the sibling `std::vector` overload's
+         * `requireValidBlockCopyRange`, matching .NET's `Buffer.BlockCopy`, which checks
+         * all three inputs before its internal `Memmove`. The upper-bound limitation is
+         * unchanged and remains the caller's responsibility. See
+         * `docs/CoreMemorySafetyFamilyPlan.md` (CMS-A).
+         *
          * @param src       Pointer to the source region.
          * @param srcOffset Byte offset into @p src.
          * @param dst       Pointer to the destination region.
          * @param dstOffset Byte offset into @p dst.
          * @param count     Number of bytes to copy.
+         * @throws System::ArgumentOutOfRangeException if @p srcOffset, @p dstOffset, or
+         *         @p count is negative.
          */
         static void BlockCopy(const void* src, intcs srcOffset,
                                void* dst, intcs dstOffset, intcs count) {
+            System::ArgumentOutOfRangeException::ThrowIfNegative(srcOffset, "srcOffset");
+            System::ArgumentOutOfRangeException::ThrowIfNegative(dstOffset, "dstOffset");
+            System::ArgumentOutOfRangeException::ThrowIfNegative(count, "count");
             std::memmove(static_cast<bytecs*>(dst) + dstOffset,
                          static_cast<const bytecs*>(src) + srcOffset,
                          static_cast<size_t>(count));
 
@@ -11,6 +11,9 @@
 #include <string>
 #include <vector>
 
+#include "System/ArgumentOutOfRangeException.hpp"
+#include "System/Buffer.hpp"
+#include "System/Exception.hpp"
 #include "System/SpanSplitEnumerator.hpp"
 
 using SharpRuntime::intcs;
@@ -147,3 +150,98 @@ TEST(CoreMemorySafetySplitTests, EmptySequenceOverNonTrivialElements) {
     EXPECT_EQ(e.getCurrentSpan().getLengthProperty(), 2);
     EXPECT_FALSE(e.MoveNext());
 }
+
+// ===========================================================================
+// SR-AUD-067 (CMS-A) -- raw Buffer::BlockCopy validates its signed metadata
+// ===========================================================================
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_NegativeCountIsRejected) {
+    SharpRuntime::bytecs src[4] = {1, 2, 3, 4};
+    SharpRuntime::bytecs dst[4] = {0, 0, 0, 0};
+    EXPECT_THROW(System::Buffer::BlockCopy(src, 0, dst, 0, -1),
+                 System::ArgumentOutOfRangeException);
+    // No write happened: rejection precedes every byte of the memmove.
+    EXPECT_EQ(dst[0], 0);
+    EXPECT_EQ(dst[3], 0);
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_NegativeSrcOffsetIsRejected) {
+    SharpRuntime::bytecs src[4] = {1, 2, 3, 4};
+    SharpRuntime::bytecs dst[4] = {0, 0, 0, 0};
+    EXPECT_THROW(System::Buffer::BlockCopy(src, -4, dst, 0, 4),
+                 System::ArgumentOutOfRangeException);
+    EXPECT_EQ(dst[0], 0);
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_NegativeDstOffsetIsRejected) {
+    SharpRuntime::bytecs src[4] = {1, 2, 3, 4};
+    SharpRuntime::bytecs dst[4] = {0, 0, 0, 0};
+    EXPECT_THROW(System::Buffer::BlockCopy(src, 0, dst, -4, 4),
+                 System::ArgumentOutOfRangeException);
+    EXPECT_EQ(dst[0], 0);
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_ParamNamesAndOrderMatchTheVectorOverload) {
+    SharpRuntime::bytecs src[4] = {1, 2, 3, 4};
+    SharpRuntime::bytecs dst[4] = {0, 0, 0, 0};
+    // srcOffset is reported before dstOffset, which is reported before count --
+    // the same order requireValidBlockCopyRange uses for the checked vector overload.
+    auto paramOf = [&](intcs so, intcs dof, intcs n) {
+        try { System::Buffer::BlockCopy(src, so, dst, dof, n); }
+        catch (const System::ArgumentOutOfRangeException& e) { return std::string(e.getParamNameProperty()); }
+        return std::string("<no throw>");
+    };
+    EXPECT_EQ(paramOf(-1, -1, -1), "srcOffset");
+    EXPECT_EQ(paramOf(0, -1, -1), "dstOffset");
+    EXPECT_EQ(paramOf(0, 0, -1), "count");
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_ValidCallsAreUnchanged) {
+    SharpRuntime::bytecs src[4] = {1, 2, 3, 4};
+    SharpRuntime::bytecs dst[4] = {0, 0, 0, 0};
+    System::Buffer::BlockCopy(src, 0, dst, 0, 4);
+    EXPECT_EQ(dst[0], 1);
+    EXPECT_EQ(dst[3], 4);
+
+    SharpRuntime::bytecs dst2[4] = {9, 9, 9, 9};
+    System::Buffer::BlockCopy(src, 1, dst2, 2, 2);
+    EXPECT_EQ(dst2[0], 9);
+    EXPECT_EQ(dst2[2], 2);
+    EXPECT_EQ(dst2[3], 3);
+
+    // count == 0 is legal and must stay legal.
+    SharpRuntime::bytecs dst3[4] = {5, 5, 5, 5};
+    System::Buffer::BlockCopy(src, 0, dst3, 0, 0);
+    EXPECT_EQ(dst3[0], 5);
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_OverlappingRegionsStillMove) {
+    // memmove semantics were already correct here and must remain so.
+    SharpRuntime::bytecs buf[5] = {1, 2, 3, 4, 5};
+    System::Buffer::BlockCopy(buf, 0, buf, 1, 4);
+    EXPECT_EQ(buf[0], 1);
+    EXPECT_EQ(buf[1], 1);
+    EXPECT_EQ(buf[2], 2);
+    EXPECT_EQ(buf[3], 3);
+    EXPECT_EQ(buf[4], 4);
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_RejectionIsCatchableAsSystemException) {
+    SharpRuntime::bytecs src[1] = {1};
+    SharpRuntime::bytecs dst[1] = {0};
+    EXPECT_THROW(System::Buffer::BlockCopy(src, 0, dst, 0, -1), System::Exception);
+}
+
+TEST(CoreMemorySafetyRawBufferTests, RawBlockCopy_NegativeOffsetIsRejectedEvenWithZeroCount) {
+    // The case the old code "got away with": a zero count means memmove copies nothing,
+    // so a negative offset produced no observable failure while still forming a pointer
+    // before its own buffer. It is invalid metadata either way and is rejected either way.
+    SharpRuntime::bytecs src[4] = {1, 2, 3, 4};
+    SharpRuntime::bytecs dst[4] = {0, 0, 0, 0};
+    EXPECT_THROW(System::Buffer::BlockCopy(src, -4, dst, 0, 0),
+                 System::ArgumentOutOfRangeException);
+    EXPECT_THROW(System::Buffer::BlockCopy(src, 0, dst, -4, 0),
+                 System::ArgumentOutOfRangeException);
+    EXPECT_THROW(System::Buffer::BlockCopy(src, SharpRuntime::INTCS_MIN, dst, 0, 0),
+                 System::ArgumentOutOfRangeException);
+}