`string_matching.nfa_scan` scans input with bounded bytecode opcodes: `1,byte` literal, `2` any byte, `3,byte` zero-or-more literal, `4` zero-or-more any byte, and `255` accept. Programs are capped at 4 KiB, inputs at 64 MiB, and the combined state budget at 16 MiB.