Value at exactly len(data) makes tokenEnd return len(data); an omitted bounds check slices data[offset:endOffset] past the buffer end and panics with index-out-of-range.

lastMatched state in searchKeys leaks across sibling object keys, so two Get calls on identical []byte can resolve to different value slices for the same path.

Get on a bare scalar payload ("null"/"true") with no key path regresses the no-keys fast path to return an empty slice or wrong ValueType instead of the scalar bytes.

Get on a zero-length []byte drives internalGet nextToken to -1; the subsequent data[offset] dereference in getType panics with index-out-of-range on the empty slice.

Returned value slice aliases the input buffer via value[:len(value):len(value)]; a caller mutating the buffer between calls sees the prior Get result silently change.

Adversarial JSON like {"a":,} drives searchKeys data[i] dereference on a delimiter with no following value, replicating the OSS-Fuzz Delete panic class on Get.

A stale valueFound from a prior sibling match in the same call leaves Get returning a wrong-key byte slice instead of KeyPathNotFoundError, silently corrupting downstream decoding.

Path [-1] parses to aIdx=-1 via strconv.Atoi with no sign check; the curIdx match never fires and stale valueOffset arithmetic can panic on stale-offset dereference.

Get(nil) flows into searchKeys; nextToken on the nil slice returns -1 and getType(nil,0) data[offset] dereference panics with nil-slice index-out-of-range.

When searchKeys/blockEnd/nextToken return the -1 sentinel for not-found, internalGet/ArrayEach dereference data[offset] without re-checking offset>=0 (the OSS-Fuzz Delete panic class).

Payload like {"a": with no value drives nextToken to -1 on the remainder; the subsequent data[offset] dereference in getType panics with index-out-of-range.

Payload like {"key with no closing quote drives stringEnd to -1; if the break guard regresses, searchKeys continues and dereferences data[i] past len(data), crashing the process.

Payload like {"a":[1,2 with no matching close bracket drives blockEnd to -1; if the return-check regresses the unbounded loop dereferences past the buffer end, crashing the parser.

Get on a JSON String where the caller expected Number returns quoted bytes; strconv.ParseInt on the quoted token silently returns 0 instead of an explicit type error.