qmdb/sync/gaps: clamp checked_add to range.end instead of unwrap-panic

Signed-off-by: SAY-5 <say.apm35@gmail.com>

Author: SAY-5

storage/src/qmdb/sync/gaps.rs

@@ -37,18 +37,25 @@ pub fn find_next<'a, F: Family>(
     let mut next_uncovered: Location<F> = range.start;
 
     // Create iterators for both data structures (already sorted)
+    // `Location::checked_add` returns `None` on overflow *or* when the result
+    // exceeds `Family::MAX_LEAVES`. The previous unconditional `.unwrap()`
+    // panicked on fuzzer-generated inputs that placed `start_loc` near the
+    // ceiling. Clamp such ranges to `range.end` instead — semantically the
+    // batch is already at the boundary, so the merge logic terminates the
+    // loop on the next iteration as expected (#2068).
+    let range_end = range.end;
     let mut fetched_ops_iter = fetched_operations
         .iter()
         .map(|(&start_loc, &operation_count)| {
-            let end_loc = start_loc.checked_add(operation_count).unwrap();
+            let end_loc = start_loc.checked_add(operation_count).unwrap_or(range_end);
             start_loc..end_loc
         })
         .peekable();
 
     let mut outstanding_reqs_iter = outstanding_requests
         .into_iter()
         .map(|&start_loc| {
-            let end_loc = start_loc.checked_add(fetch_batch_size.get()).unwrap();
+            let end_loc = start_loc.checked_add(fetch_batch_size.get()).unwrap_or(range_end);
             start_loc..end_loc
         })
         .peekable();