read what the binary says about itself: names, signatures, prototypes; gen v2

fuzz/fuzz_targets/fuzz_schema.rs

@@ -11,6 +11,16 @@ fuzz_target!(|data: &[u8]| {
     let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
         return;
     };
+    // The enum bindings are a SECOND table read the same reloc-driven way: a name pointer, a
+    // width/count word, and an enumerator array whose length that word supplies. A crafted count is the
+    // sharp edge — it drives the per-enumerator read loop — so the reader must bound it rather than
+    // trust it.
+    for e in schema::enumerate_enums(&img) {
+        let _ = (e.name.len(), e.size, e.align);
+        for (n, v) in &e.values {
+            let _ = (n.len(), *v);
+        }
+    }
     for c in schema::enumerate_schema(&img) {
         let _ = c.primary_base();
         for f in &c.fields {