# Problems — tofu-core

Unresolved blockers and technical debt discovered during work on this plan.

_Auto-scaffolded by /start-work. Append new entries below - never overwrite._

---

## BUG FOUND (task 27 smoketest): info.d scanDepsArray — unsigned type stores signed indexOf result

**Severity:** High (crash on any recipe without `deps` field)

**Location:** `src/tofu/commands/info.d:93`

**Root cause:**
`size_t pos = content.indexOf("deps")` — indexOf returns ptrdiff_t (-1 for not found), storing it in size_t (unsigned) wraps -1 to SIZE_MAX. The guard `pos < 0` is always false for unsigned types. When deps is absent, `content[pos - 1]` accesses far out of bounds → ArrayIndexError.

**Why it escaped unit tests:** All 8 info.d unittests use recipes containing a `deps` field. The crash only triggers when `deps` is completely absent.

**Impact:** `tofu -Si` crashes on recipes without `deps` with an uncaught ArrayIndexError (D Error, not Exception — bypasses catch blocks).

**Fix (to be dispatched):** Change `size_t pos` to `ptrdiff_t pos` at line 93.

**Workaround in smoketest:** Recipe includes `deps = {}` to avoid triggering this bug.