If ObjectEach/ArrayEach swallow a callback returned error and continue iterating, the next iteration invokes the callback on stale offset state, corrupting traversal and dereferencing past the buffer end.

EachKey callback order on identical input must be deterministic; a regression in pathFlags match order produces callbacks in different order across calls, breaking deterministic processing.

ArrayEach on a single-element array must invoke the callback exactly once; a regression in the post-callback offset arithmetic invokes it twice or zero times, breaking the count contract.

ArrayEach on a zero-length []byte returns MalformedObjectError via the early guard; if the guard regresses nextToken returns -1 and the follow-on data[offset] dereference panics on the empty slice.

ArrayEach on adversarial JSON like [1,2,,] drives Get to a parse error mid-array; if the error-propagation guard regresses the loop continues past the malformed token and dereferences data[offset] past len(data).

ObjectEach(nil,...) flows through searchKeys nil-slice loop; the subsequent nextToken/data[offset] dereference panics with nil-slice index-out-of-range.

When searchKeys or blockEnd returns -1 sentinel for malformed structure, ArrayEach/EachKey dereference data[offset] without re-checking offset>=0 (the OSS-Fuzz Delete panic class).

Truncated JSON like [1,2 with no closing bracket drives nextToken in ArrayEach to -1; the follow-on data[offset] dereference panics with index-out-of-range on the truncated remainder.

Truncated JSON like [1,"abc with no closing string mid-element drives Get to stringEnd returning -1; the follow-on data[offset] dereference in ArrayEach panics past the buffer end.

Truncated JSON like {"a":[1,2 with no matching close bracket drives blockEnd to -1; if the guard regresses the unbounded loop dereferences past the buffer end, crashing the process.