Constant MAX_FRAMES 

pub const MAX_FRAMES: u64 = _; // 16_777_216u64

v0.8.15 H-c: hard upper bound on the number of entries decode_index will accept. 16 M × 32 B = 512 MiB sidecar body — orders of magnitude over any real workload (a typical 5 GiB object hits ~1280 frames at the 4 MiB default chunk). Above this we’d be parsing an attacker payload, not a legitimate sidecar.