Follow-ups to 854eeb0: funcptrs_win v3-span backfill + string-overload AOOR guard

Two extensions of the same bug family 854eeb0 addressed for span overloads:

1. funcptrs_win.cs v3-span ReadOnlySpan overload was missed in 854eeb0
   (the other three provider variants got the guard there, and the
   provider.tt template was already updated correctly).  Re-sync
   funcptrs_win.cs with the template.

2. raw.cs string overloads of sqlite3_prepare_v2/v3 still sliced the
   returned span unconditionally.  With 854eeb0 making the provider
   return an empty span on error, the slice becomes sp_tail.Slice(0, -1)
   and throws ArgumentOutOfRangeException.  Guard the slice behind
   sp_tail.Length > 0.

Adds two regression tests that deterministically fire the AOOR on
unpatched string-overload code by closing the db with manual_close_v2
and growing the heap into the bit-31-clear address range.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jamescater2

src/SQLitePCLRaw.core/raw.cs

@@ -830,7 +830,8 @@ static public int sqlite3_prepare_v2(sqlite3 db, string sql, out sqlite3_stmt st
             var ba = sql.to_utf8_with_z();
             var sp = new ReadOnlySpan<byte>(ba);
             int rc = sqlite3_prepare_v2(db, sp, out stmt, out var sp_tail);
-            tail = utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1));
+            // Audit #1: provider now returns an empty span on error; guard Slice(0, -1).
+            tail = sp_tail.Length > 0 ? utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1)) : "";
             return rc;
         }
 
@@ -874,7 +875,8 @@ static public int sqlite3_prepare_v3(sqlite3 db, string sql, uint flags, out sql
             var ba = sql.to_utf8_with_z();
             var sp = new ReadOnlySpan<byte>(ba);
             int rc = sqlite3_prepare_v3(db, sp, flags, out stmt, out var sp_tail);
-            tail = utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1));
+            // Audit #1: provider now returns an empty span on error; guard Slice(0, -1).
+            tail = sp_tail.Length > 0 ? utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1)) : "";
             return rc;
         }
 

src/SQLitePCLRaw.provider.e_sqlite3/Generated/provider_e_sqlite3_funcptrs_win.cs

@@ -304,11 +304,12 @@ unsafe int ISQLite3Provider.sqlite3_prepare_v3(sqlite3 db, ReadOnlySpan<byte> sq
             fixed (byte* p_sql = sql)
             {
                 var rc = NativeMethods.sqlite3_prepare_v3(db, p_sql, sql.Length, flags, out stm, out var p_tail);
-                var len_consumed = (int) (p_tail - p_sql);
-                int len_remain = sql.Length - len_consumed;
-                if (len_remain > 0)
+                // Follow-up to 854eeb0: funcptrs_win's v3 span variant was missed in that commit — same p_tail bounds guard as the other three provider variants.
+                if (p_tail != null && p_tail >= p_sql && p_tail <= p_sql + sql.Length)
                 {
-                    tail = sql.Slice(len_consumed, len_remain);
+                    var len_consumed = (int) (p_tail - p_sql);
+                    int len_remain = sql.Length - len_consumed;
+                    tail = len_remain > 0 ? sql.Slice(len_consumed, len_remain) : ReadOnlySpan<byte>.Empty;
                 }
                 else
                 {

src/common/tests_xunit.cs

@@ -433,6 +433,64 @@ public void test_prepare_v3_span_tolerates_uninitialised_pzTail()
             GC.KeepAlive(rolling);
         }
 
+        // Audit #1: the string overloads of prepare_v2/v3 used to throw
+        // ArgumentOutOfRangeException on the same MISUSE path because they
+        // unconditionally sliced the (now empty) tail span.  These tests
+        // assert they return rc cleanly with an empty tail string instead.
+        [Fact]
+        public void test_prepare_v2_string_tolerates_uninitialised_pzTail()
+        {
+            var rolling = new byte[256][];
+            var rnd = new Random(42);
+            for (var i = 0; i < 512; i++)
+            {
+                rolling[i % rolling.Length] = new byte[rnd.Next(1024, 128 * 1024)];
+
+                var db = ugly.open(":memory:");
+                db.manual_close_v2();
+                try
+                {
+                    int rc = raw.sqlite3_prepare_v2(db, "SELECT 1;", out var stmt, out string tail);
+
+                    Assert.Equal(raw.SQLITE_MISUSE, rc);
+                    Assert.Equal("", tail);
+                    stmt?.Dispose();
+                }
+                finally
+                {
+                    db.Dispose();
+                }
+            }
+            GC.KeepAlive(rolling);
+        }
+
+        [Fact]
+        public void test_prepare_v3_string_tolerates_uninitialised_pzTail()
+        {
+            var rolling = new byte[256][];
+            var rnd = new Random(42);
+            for (var i = 0; i < 512; i++)
+            {
+                rolling[i % rolling.Length] = new byte[rnd.Next(1024, 128 * 1024)];
+
+                var db = ugly.open(":memory:");
+                db.manual_close_v2();
+                try
+                {
+                    int rc = raw.sqlite3_prepare_v3(db, "SELECT 1;", 0, out var stmt, out string tail);
+
+                    Assert.Equal(raw.SQLITE_MISUSE, rc);
+                    Assert.Equal("", tail);
+                    stmt?.Dispose();
+                }
+                finally
+                {
+                    db.Dispose();
+                }
+            }
+            GC.KeepAlive(rolling);
+        }
+
         [Fact]
         public void test_bind_parameter_index()
         {