The moz.yaml for media/libnestegg lists a single local patch, patches/0001-clamp-nestegg-uint-reads.patch, a documentation-only patch that adds a comment noting the RFC 8794 EBML unsigned-integer length limit above the length check in ne_read_uint.

The patch failed to apply because upstream refactored ne_read_uint between the version the patch was written against and the current vendored revision (1c9936b171b7e37efce87f7af247c7af0e3ea5b8): the guard changed from if (length == 0 || length > 8) to if (length > 8) (a zero-length unsigned integer is now accepted and decoded as the value 0), and the read logic was restructured from a read-first form into a *val = 0; while (length--) loop.

I re-anchored the patch's single hunk so the comment is inserted above the new if (length > 8) guard. The patch's intent (documenting the length limit) and its location (top of ne_read_uint, above the length check) are unchanged, and it now applies cleanly via ./mach vendor --patch-mode only.

Outcome: uncertain success. The upstream change is non-trivial and touches exactly what the comment documents: the code no longer enforces the lower bound (length != 0), so the comment's "1..8 bytes wide ... enforced" wording now describes only the upper bound the guard still enforces. A human should confirm the comment wording is still appropriate for the new behavior.