It has no symbol count to stop on and runs until the bitstream is spent, so
its own room check is the only thing keeping it inside the caller's buffer.
Both exhausted branches write a third symbol in the same pass. This is the
53-byte reproducer with the frame stripped away, so a regression points at
the function rather than at a block somewhere.
