Fix wrong-result and UB bugs found by second memory/thread-safety sweep

[Qubitium]

Summary

Follow-up to #108. After that PR merged, a clean re-audit of main was run: a fresh-eyes review of pcre2.c, a deep pass over the helper files that had lighter coverage the first time, a second pass over the Python layer, and an adversarial review of the #108 diff itself — which found no regressions (the exclusive-ownership context cache, FindIter locking, GC wiring, and allocator changes all held up under source scrutiny and multi-threaded stress on 3.14/3.14t). The sweep did surface the following remaining bugs, now fixed. The first three are user-visible wrong-result bugs reproducible from the public API today.

Wrong results / undefined behavior

Bug	Symptom	Fix
utf8_index_to_offset chunk-boundary error (util.c)	The 8-byte starter scan could return an offset pointing inside a multi-byte character when a chunk boundary splits it near the string tail. pcre.compile('.').search('𐍈a𐍈b', 3) → span (3,3), .group() raises UnicodeDecodeError (re gives (3,4)); str subjects always run PCRE2_NO_UTF_CHECK, so PCRE2 also received mid-codepoint offsets — documented UB	Tail scan now always skips trailing continuation bytes
Interpreter fallback keyed on the pattern-global jit flag (Pattern_execute)	Any call that skips JIT locally while pattern->jit_enabled stays set ran neither engine: rc stayed 0 and the uninitialized match_data became a Match with garbage offsets (segfault on .group()). Latent until the partial-range JIT skip below armed it — caught by this PR's own regression tests	Per-call jit_produced_result flag decides the fallback
First-literal prescan vs. inline caselessness	(?i:abc), ((?i)abc) report a first code unit but their caselessness is invisible to pattern_info, so pcre.compile('(?i:abc)').search('ABC') → None	Prescan accepts both cases of an ASCII letter (still a pure filter; PCRE2 only reports a non-ASCII first unit when all case variants share it)
JIT bypasses UTF offset validation	pcre2_jit_match performs none of the checks the module relies on for partial bytes ranges: mid-character pos on a UTF bytes subject returned None under JIT where the interpreter raises PcreErrorBadutfoffset — and executed JIT code on malformed boundaries	Partial ranges of UTF bytes subjects take the interpreter path (execute, findall, finditer)
PCRE2_NO_UTF_CHECK smuggling via options=	User-supplied flag reached pcre2_match unmasked; with a mid-character pos that is documented UB triggerable from Python	Masked out of caller options everywhere; the module re-adds it only for validated ranges

Free-threading / liveness

• Stop-the-world stalls (GIL=0): free-threaded builds never detached the thread state around PCRE2 calls, so a thread in a long pcre2_match (huge subject, catastrophic backtracking) blocked every gc.collect() in the process until the match finished. Large calls now detach exactly like GIL builds (same 256 KiB threshold).
• Match_expand borrowed-ref UAF: the expand_match_template helper was fetched with PyDict_GetItemString and INCREF'd afterwards — a concurrent rebind (monkeypatch/reload) could free it in the window. Now a strong reference via PyObject_GetAttrString. Same class as the error.c fix in Fix memory and thread-safety issues for free-threaded (GIL=0) Python #108.
• jit serial lock latch: importlib.reload with PYPCRE_FORCE_JIT_LOCK newly set could materialize jit_serial_lock while a thread was between jit_guard_acquire (saw NULL, took nothing) and jit_guard_release (sees the lock, releases it) — permanently breaking JIT serialization. jit_support_initialize and pattern_cache_initialize (whose mode flip had the analogous problem) are now latched to first init.
• Pattern_substitute guard completeness: pcre2_substitute executes JIT code even after a JIT_BADOPTION downgrade cleared the module's flag; the guard is now also keyed on PCRE2_INFO_JITSIZE.

Smaller fixes

• PYPCRE_DISABLE_CONTEXT_CACHE was dead: cache_initialize unconditionally re-stored context_cache_enabled = 1 right after module_exec applied the env toggle.
• PyErr_Format doesn't support %.*s — an out-of-range \U escape raised SystemError instead of PcreError (string_helpers.c).
• MSVC-fallback _Generic maps in atomic_compat.h listed volatile uint32_t* and volatile size_t* — identical types on 32-bit Windows, a compile error; the size_t associations are now conditional on 64-bit size_t.
• threads.py: the macOS sysctl probe could still run under the process-wide pool lock via ensure_thread_pool / _thread_pool_submission / get_thread_pool_size (the Fix memory and thread-safety issues for free-threaded (GIL=0) Python #108 fix only covered configure_thread_pool); it's now resolved before the lock everywhere.

Verified intentional (not changed)

• Per-thread set_cache_limit/clear_cache scoping in pcre/cache.py — flagged by the audit but explicitly asserted by test_cache_limit_thread_local_isolated as the designed semantics.
• FindIter's PyMutex held across match-object allocation: a reentrancy probe (GC threshold 1, cyclic __del__ calling next() on the same iterator, 685 reentries) confirmed GC cannot fire inside the C iternext call, so no self-deadlock path exists.

Testing

• CPython 3.14.7 free-threaded (sys._is_gil_enabled() == False) and 3.14.7 GIL, Linux x86-64, PCRE2 10.46.
• Full pytest suite green on both: 838 passed + 545 subtests (FT), 833 passed + 545 subtests (GIL).
• New differential regression script for every fix above: utf8_index_to_offset across astral/2-byte subjects at all positions vs re; inline-caseless literal patterns; JIT-vs-interpreter parity on partial UTF bytes ranges (match/search/finditer); NO_UTF_CHECK smuggling now raises PcreErrorBadutfoffset; \U00110000 raises PcreError not SystemError.
• Multithreaded stress suite from Fix memory and thread-safety issues for free-threaded (GIL=0) Python #108 re-run on both builds: no crashes, errors, or deadlocks.

🤖 Generated with Claude Code