[mikecerisano]

Selecting a card could load an entire camera metadata sidecar just to guess a camera label. A large .ARI, XML, XMP, DAT, or ALE file could therefore consume far more memory than a naming hint warrants. These readers now use a shared 4 MiB cap, require a regular file, refuse leaf symlinks, check cancellation while reading, and discard truncated or oversized input instead of parsing a partial prefix. Sony, Canon, Panasonic, and ARRI continue to later candidates so a bad or generic first sidecar cannot hide a valid model.

This is advisory camera naming/fingerprinting only. It does not change the transfer set, source files, destination writes, verification, reports, or safety verdicts. A legitimate sidecar above the cap may result in a generic or missing camera label.

Local validation:

• Focused Mac sidecar regression suite: 12/12 passed, including size boundary, FIFO, leaf symlink, mid-read cancellation/truncation, later valid sidecars, and preserved small-file labels.
• Repository's exact full ./test.sh mac-test on the final PR head: 1,226 passed, 14 skipped, 0 failed.
• ./test.sh ipad-build on the final PR head: passed.
• After rebasing onto current main (ac860897), the source/test diff remained byte-identical and focused Mac tests passed 12/12 again; git diff --check is clean.

Scope limits: O_NOFOLLOW protects the opened leaf, not every ancestor directory. The existing first-three XML work budget in shared detection is unchanged, and ImageIO's separate media-metadata path is outside this sidecar-read change. This does not establish a cause or fix for issue #23.