Keep CSO frame and block counts wide until validating their 32-bit representation, preventing numFrames + 1 from wrapping. Also reject index tables that cannot fit in the source file or host size_t before allocation and indexing.