From af4970e388fd9714e33d200ed5ef35bbdb7f2a85 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Thu, 29 Oct 2026 21:58:53 -0400
Subject: [PATCH] Saturate the reference POC LSB after a memory management op 5

A saturated top POC with a negative bottom field could still overflow
here, as CodeRabbit noted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/video/src/h264/slice.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/video/src/h264/slice.rs b/crates/video/src/h264/slice.rs
index 0e9b3465..02bcb0ba 100644
--- a/crates/video/src/h264/slice.rs
+++ b/crates/video/src/h264/slice.rs
@@ -532,7 +532,7 @@ impl PocState {
         if sh.nal_ref_idc != 0 {
             if mmco5 {
                 self.prev_ref_msb = 0;
-                self.prev_ref_lsb = poc.top - poc.frame();
+                self.prev_ref_lsb = poc.top.saturating_sub(poc.frame());
             } else {
                 self.prev_ref_msb = poc.msb;
                 self.prev_ref_lsb = sh.pic_order_cnt_lsb as i32;