func _io_clamp(count: Int, capacity: Int) -> Int'io replies are untrusted for memory safety: a user handler may intercept any request (ADR 0039), so a count is clamped to the capacity the caller actually allocated before it becomes a view's length. A lying handler yields wrong data, never an out-of-bounds view. _io_clamp(n, n) sanitizes a bare length (negative becomes 0).
View Source
pub func _io_clamp(count: Int, capacity: Int) -> Int {
if count < 0 { return 0 }
if count > capacity { return capacity }
count
}