ObjectScript scanners pass a null empty-state buffer to memcpy #2799

ObjectScript routine and UDL external scanners unconditionally call memcpy(payload, buffer, length) during deserialization. The vendored Tree-sitter runtime initializes the deserialization input to data = NULL, length = 0 when no external scanner state exists, then calls the language scanner with that input. Passing NULL to memcpy is undefined even when the copy length is zero.

On main 6efe33b7, compiling each actual scanner with -fsanitize=undefined -fno-sanitize-recover=all and calling its exported deserialize function after create with (payload, NULL, 0) exits 1: runtime error: null pointer passed as argument 2, which is declared to never be null. Routine fails at scanner.c:118; UDL at scanner.c:122. Guarding the copy with if (length > 0) makes both cases pass and preserves nonempty serialized-state round trips.

Expected: accept Tree-sitter's empty-state callback without a sanitizer error while retaining nonempty deserialization behavior.

Related: #2368 already includes equivalent guards within a broader grammar re-vendor for Python bodies. A separate minimal sanitizer patch can land independently; it should add focused regression coverage and record both local patches in the vendoring manifest/checksums.

AI assistance: OpenAI Codex investigated and prepared this report on behalf of WarGloom.