Function corrupt 

fn corrupt(path: &Path, what: String) -> Error

A block file whose own metadata does not describe it.

Every length and offset in open_table is read out of the file, which makes it attacker-controlled-equivalent — a disk bit flip being the realistic case. Unchecked, they index the mapping out of bounds, and panic = "abort" (workspace release profile) turns that into a process death rather than a caught error: every open block and in-flight export dies with it, the bad block is still on disk afterwards, and the restart hits the same byte. One bad byte becomes an unattended crashloop. As an error it is one table a query skips.

ponytail: io::ErrorKind::InvalidData inside Error::Io rather than an Error::CorruptBlock of its own, following the NUL-byte case in fs_type. Every caller today treats a block it cannot read the same way whatever the reason; give it a variant when one of them needs to match on it.