A table variable or TVP bound to a stored-proc READONLY parameter now copies off-row data correctly.

Author: RyanLamansky

docs/claude/backlog.md

@@ -42,7 +42,8 @@ Remaining phases, roughly in value order:
   **`text`/`ntext`/`image` ship fully** (2026-07-19) — result columns, `image` (0x22) input parameters, and **`SqlBulkCopy` into a legacy-LOB column** (2026-07-19: the BCP LONGLEN COLMETADATA + in-band text-pointer ROW value now decode); see [`tds-endpoint.md`](tds-endpoint.md#legacy-text--ntext--image-wire-forms).
   **`sql_variant` and UDT (`geography`/`geometry`/`hierarchyid`) ship as RPC *input* parameters AND as *columns inside a TVP*** (2026-07-19 — the shared decoder made the TVP columns near-free; see [`tds-endpoint.md`](tds-endpoint.md#tvp-parameters-sqldbtypestructured)).
   **TVP parameters (0xF3, `SqlDbType.Structured`) ship** — `DataTable` / `IEnumerable<SqlDataRecord>` / `DbDataReader` sources over proc-RPC + sp_executesql, error parity for arity / type / NOT NULL / CHECK / PK / UNIQUE / unknown-type.
-  Residuals: **output-direction** UDT / `sql_variant` params; **`SET TEXTSIZE`** doesn't truncate returned LOB data (parse-and-discard); a **LOB-backed TVP column** (`nvarchar(max)` / `geography` / `geometry`) bound to a **stored-proc READONLY parameter** hits a pre-existing table-variable LOB-copy gap in proc-parameter binding (the copied row's LOB pointers dangle — reproducible in-process, unrelated to the wire; the `sp_executesql` text path is clean, and the crash boundary surfaces it as a severe error not a silent reset).
+  Residuals: **output-direction** UDT / `sql_variant` params; **`SET TEXTSIZE`** doesn't truncate returned LOB data (parse-and-discard).
+  (The LOB-backed TVP column → stored-proc READONLY parameter dangling-pointer bug was fixed 2026-07-19: the proc-parameter copy re-homes off-row values into the parameter's heap; see [`table-valued-parameters.md`](table-valued-parameters.md).)
 - **Smaller fidelity items**: TDS 8.0 / `Encrypt=Strict` (ALPN via `SslApplicationProtocol`); user-supplied `X509Certificate2` — an add-on-demand public-surface expansion.
   (Off-loopback binding shipped 2026-07-19 as `ListenNetworkAsync`, gated on a registered login; per-interface bind-address selection remains add-on-demand.)
   (**Terminal crash boundary** shipped 2026-07-19 — an exception outside the typed catch list now emits a best-effort Msg 0 / severity 20 ERROR at a token boundary instead of a silent transport reset, `AtTokenBoundary`-gated for mid-token safety, on both the non-MARS and MARS session loops; see [`tds-endpoint.md`](tds-endpoint.md#terminal-crash-boundary).

docs/claude/table-valued-parameters.md

@@ -101,6 +101,8 @@ Two-shape recognition in `ParseExecArgument`:
 - Allocates a parallel `boundTableValues` array alongside `boundValues`.
 - For each TVP parameter: clones the type into a fresh TVP-flagged `HeapTable`, then bulk-copies the supplied source's rows via `Heap.EnumerateRows()` → `Heap.Insert()`.
   Pass-by-value semantics matching real SQL Server's TVP copy.
+  When the type has any off-row-capable column (`Heap.ReclaimColumns` non-null — a LOB-typed column or any variable-length column, since bounded var columns overflow-push past 8060 bytes), each row decodes from the source heap and re-encodes against the clone's heap so LOB chains are re-homed; raw row bytes would carry pointers into the *source* heap's `LobPages` and dangle.
+  Pointer-free schemas keep the raw byte copy.
 - Unsupplied TVP parameters get an empty clone (probe-confirmed: `EXEC p` with the TVP arg omitted is legal).
 - Scalar argument passed to a TVP parameter raises **Msg 206** ("Operand type clash: int is incompatible with `<typeleaf>`") — probe-confirmed wording, with the table-type leaf name (no schema qualifier).
 

docs/claude/tds-endpoint.md

@@ -254,8 +254,7 @@ Probed against SQL Server 2025 + SqlClient 7.0.2 (2026-07-18).
   Enforcing NOT NULL / CHECK / PK / UNIQUE on the structured path is a fidelity upgrade shared with the in-process path (which previously skipped them via a direct `Heap.Insert`).
 - **`sql_variant` / UDT columns** decode (2026-07-19): a `sql_variant` TVP column arrives as `0x62` + a 4-byte max length with a 4-byte-total-length (0 = NULL) self-describing body value; a `hierarchyid` / `geography` / `geometry` column arrives as `0xF0` + three B_VARCHARs (db / schema / type) with a PLP value — **the same wire forms the matching RPC parameters carry** (cleartext-probed inside TVP_COLMETADATA / TVP_ROW against SQL Server 2025 + SqlClient 7.0.2), so unification made them decode for near-free.
   Oracle: `TvpVariantUdtColumnTests`.
-  **Caveat**: a LOB-backed TVP column (`geography` / `geometry`, like `nvarchar(max)`) round-trips fine through the `sp_executesql` text path (the parameter is a batch table variable), but routing it through a **stored-procedure READONLY parameter** hits a pre-existing table-variable LOB-copy gap in proc-parameter binding (the copied row's LOB pointers dangle) — reproducible in-process too, and unrelated to the wire decode.
-  The terminal crash boundary now surfaces that as a clean severe error rather than a silent transport reset; the tests use the text path.
+  A LOB-backed TVP column (`geography` / `geometry`, like `nvarchar(max)`) round-trips through both the `sp_executesql` text path (the parameter is a batch table variable) **and** a **stored-procedure READONLY parameter** — the proc-parameter copy re-homes off-row values into the parameter's own heap (see [`table-valued-parameters.md`](table-valued-parameters.md)); `TvpVariantUdtColumnTests.LobBackedColumns_ThroughProcReadonlyParameter_RoundTrip` covers the proc route.
 - **Residuals**: a `DBNull`-valued Structured parameter is rejected by SqlClient client-side (`NotSupportedException`) before any bytes hit the wire, so the server never sees a null TVP (a wire TVP_NULL, column count `0xFFFF`, is handled defensively as an empty table).
   TVP_ORDER_UNIQUE (0x10) / TVP_COLUMN_ORDERING (0x11) optional metadata — never emitted by `DataTable` / `SqlDataReader` sources — is rejected with a clear ERROR rather than a guessed parse.
   An identity column present in a TVP raises **Msg 1077** on real SQL Server even for a `DBNull` value; the simulator's structured path auto-generates on `DBNull` (pre-existing in-process divergence, unchanged).

src/SqlServerSimulator/Network/CLAUDE.md

@@ -70,7 +70,7 @@ These notes are the local implementation contracts.
   UDT **input** *parameters* decode (`TdsRpc.DecodeClrUdt` → `TdsWireValue.BuildUdtValue`): the client UDT_INFO is three B_VARCHARs (db/schema/type, no max-size, no AQN — shorter than COLMETADATA) + PLP value; hierarchyid OrdPath bytes bind verbatim, spatial WKB decodes via `SpatialWkbDecoder.TryDecode`, resolved case-insensitively into a pre-built `SqlValue` (unknown type → Msg 8064, invalid spatial bytes → Msg 8023).
   **UDT columns inside a TVP** decode through the same builder (`TdsColumnDecoder`: 0xF0 + three B_VARCHARs + PLP value).
   **Output** direction stays rejected.
-  A LOB-backed UDT TVP column (`geography`/`geometry`) round-trips via the `sp_executesql` text path but hits a pre-existing table-variable LOB-copy gap when bound to a stored-proc READONLY parameter (docs/claude/tds-endpoint.md).
+  A LOB-backed UDT TVP column (`geography`/`geometry`) round-trips via both the `sp_executesql` text path and a stored-proc READONLY parameter (the proc-parameter copy re-homes off-row values — docs/claude/table-valued-parameters.md).
   Oracles: `UdtRpcParameterTests`, `TvpVariantUdtColumnTests`.
 - **Length-prefix trap**: most strings are char-counted (B_VARCHAR / US_VARCHAR), but TM-request transaction names are byte-counted — misreading them as char-counted overruns the payload on every `SqlTransaction.Save`.
   LOGIN7's password length pair is char-counted like the other LOGIN7 fields (oracle-confirmed with a surrogate-pair password); only its *bytes* are special, obfuscated per MS-TDS (client swaps nibbles then XORs 0xA5 — decode inverts the order).

src/SqlServerSimulator/Simulation/Simulation.InvokeProcedure.cs

@@ -141,8 +141,18 @@ internal IEnumerable<SimulatedStatementOutcome> InvokeProcedure(
                 var clone = tvpType.Clone("@" + param.Name, outerBatch, isTableValuedParameter: true);
                 if (boundTableValues[i] is { } supplied)
                 {
+                    // Row bytes can point into the source heap's off-row
+                    // pages (LOB chains, overflow-pushed var columns), so
+                    // off-row-capable schemas decode and re-encode each row
+                    // against the clone's heap; pointer-free schemas copy
+                    // the bytes as-is.
+                    var reencode = supplied.Heap.ReclaimColumns is not null;
                     foreach (var row in supplied.Heap.EnumerateRows())
-                        _ = clone.Heap.Insert(row);
+                    {
+                        _ = clone.Heap.Insert(reencode
+                            ? RowEncoder.EncodeRow(supplied.StoredColumns, RowDecoder.DecodeRow(supplied.StoredColumns, row, supplied.Heap), clone.Heap)
+                            : row);
+                    }
                 }
                 tableVariables[param.Name] = clone;
                 continue;

tests/SqlServerSimulator.Tests.SqlClient/TvpVariantUdtColumnTests.cs

@@ -21,12 +21,10 @@ namespace SqlServerSimulator;
 /// value — both the same forms as the matching RPC parameters.
 /// </summary>
 /// <remarks>
-/// These drive the TVP through the <c>sp_executesql</c> text path (the parameter
-/// binds as its own <c>@rows</c> table variable). Routing a LOB-backed TVP column
-/// (<c>geography</c> / <c>geometry</c>, like <c>nvarchar(max)</c>) through a
-/// stored-procedure READONLY parameter hits a pre-existing table-variable LOB-copy
-/// gap in proc-parameter binding, unrelated to the wire decode; see
-/// docs/claude/tds-endpoint.md.
+/// Most of these drive the TVP through the <c>sp_executesql</c> text path (the
+/// parameter binds as its own <c>@rows</c> table variable); the LOB-backed
+/// proc test covers the stored-procedure READONLY route, whose parameter copy
+/// re-homes off-row values into the parameter's own heap.
 /// </remarks>
 [TestClass]
 public sealed class TvpVariantUdtColumnTests
@@ -127,6 +125,43 @@ public async Task GeographyColumn_RoundTripsToWkt()
             .ExecuteScalarAsync(TestContext.CancellationToken));
     }
 
+    // LOB-backed columns (nvarchar(max), geography) bound to a stored-proc
+    // READONLY parameter: the proc-parameter copy must carry the off-row
+    // values into the parameter's table variable, not just the row bytes.
+    [TestMethod]
+    public async Task LobBackedColumns_ThroughProcReadonlyParameter_RoundTrip()
+    {
+        var simulation = new Simulation();
+        Wire.ExecInProc(simulation, "create type dbo.LobRows as table (id int, doc nvarchar(max), g geography)");
+        Wire.ExecInProc(simulation, "create table dbo.sink (id int, doc nvarchar(max), g geography)");
+        Wire.ExecInProc(simulation, "create proc dbo.ins_lob @rows dbo.LobRows readonly as insert into dbo.sink select id, doc, g from @rows");
+        await using var listener = await simulation.ListenLocalAsync(0, TestContext.CancellationToken);
+        await using var connection = await Wire.OpenAsync(listener, TestContext.CancellationToken);
+
+        var metadata = new[]
+        {
+            new SqlMetaData("id", SqlDbType.Int),
+            new SqlMetaData("doc", SqlDbType.NVarChar, SqlMetaData.Max),
+            new SqlMetaData("g", SqlDbType.Udt, typeof(SqlGeography), "geography"),
+        };
+        var record = new SqlDataRecord(metadata);
+        record.SetInt32(0, 1);
+        record.SetString(1, new string('x', 100000));
+        record.SetValue(2, SqlGeography.STGeomFromText(new SqlChars("POINT(-122.3 47.6)"), 4326));
+
+        await using var command = new SqlCommand("dbo.ins_lob", connection) { CommandType = CommandType.StoredProcedure };
+        var parameter = command.Parameters.AddWithValue("@rows", new[] { record });
+        parameter.SqlDbType = SqlDbType.Structured;
+        parameter.TypeName = "dbo.LobRows";
+        _ = await command.ExecuteNonQueryAsync(TestContext.CancellationToken);
+
+        await using var reader = await new SqlCommand("select cast(len(doc) as int), g.ToString() from dbo.sink", connection)
+            .ExecuteReaderAsync(TestContext.CancellationToken);
+        IsTrue(await reader.ReadAsync(TestContext.CancellationToken));
+        AreEqual(100000, reader.GetInt32(0));
+        AreEqual("POINT (-122.3 47.6)", reader.GetString(1));
+    }
+
     [TestMethod]
     public async Task GeometryColumn_RoundTripsToWkt()
     {

tests/SqlServerSimulator.Tests/TableValuedParameterTests.cs

@@ -262,6 +262,68 @@ public void Exec_TvpArg_NestedProcPassThrough_PreservesRows()
         AreEqual(2, sim.ExecuteScalar("declare @t dbo.t1; insert @t values (1), (2); exec dbo.outer_p @t"));
     }
 
+    // ---- Off-row values crossing the proc-parameter copy ----
+
+    // A table variable's off-row bytes (LOB chains for MAX-typed columns,
+    // and bounded var columns overflow-pushed past 8060) live in the source
+    // heap; the proc-parameter copy must re-home them into the parameter's
+    // own heap or the copied rows' pointers dangle.
+
+    [TestMethod]
+    public void Exec_TvpArg_NvarcharMaxColumn_LobValueSurvivesParameterCopy()
+    {
+        var sim = new Simulation();
+        sim.ExecuteBatches(
+            "create type dbo.t1 as table (id int, doc nvarchar(max))",
+            "create proc dbo.p1 @rows dbo.t1 readonly as select cast(len(doc) as int) l, substring(doc, 99999, 2) tail from @rows");
+        using var rdr = sim.ExecuteReader("""
+            declare @t dbo.t1;
+            insert @t values (1, replicate(cast(N'x' as nvarchar(max)), 99999) + N'y');
+            exec dbo.p1 @t
+            """);
+        IsTrue(rdr.Read());
+        AreEqual(100000, rdr.GetInt32(0));
+        AreEqual("xy", rdr.GetString(1));
+    }
+
+    [TestMethod]
+    public void Exec_TvpArg_OverflowPushedBoundedColumn_SurvivesParameterCopy()
+    {
+        var sim = new Simulation();
+        sim.ExecuteBatches(
+            "create type dbo.t1 as table (id int, a varchar(8000), b varchar(8000))",
+            "create proc dbo.p1 @rows dbo.t1 readonly as select len(a) + len(b) from @rows");
+        AreEqual(16000, sim.ExecuteScalar("""
+            declare @t dbo.t1;
+            insert @t values (1, replicate('a', 8000), replicate('b', 8000));
+            exec dbo.p1 @t
+            """));
+    }
+
+    [TestMethod]
+    public void Structured_DataTable_NvarcharMaxColumn_LobValueSurvivesParameterCopy()
+    {
+        var simulation = new Simulation();
+        _ = simulation.ExecuteNonQuery("create type dbo.t1 as table (id int, doc nvarchar(max))");
+        _ = simulation.ExecuteNonQuery("create proc dbo.p1 @rows dbo.t1 readonly as select cast(len(doc) as int) from @rows");
+
+        using var con = simulation.CreateDbConnection();
+        con.Open();
+        using var cmd = con.CreateCommand();
+        cmd.CommandText = "exec dbo.p1 @rows";
+        var dt = new DataTable();
+        _ = dt.Columns.Add("id", typeof(int));
+        _ = dt.Columns.Add("doc", typeof(string));
+        _ = dt.Rows.Add(1, new string('x', 100000));
+        var p = cmd.CreateParameter();
+        p.ParameterName = "@rows";
+        p.Value = dt;
+        p.TypeName = "dbo.t1";
+        _ = cmd.Parameters.Add(p);
+
+        AreEqual(100000, cmd.ExecuteScalar());
+    }
+
     // ---- ADO.NET Structured parameter (DataTable / IDataReader) ----
 
     [TestMethod]