[nmatt0]

Summary

Fixes #45. signatures/lzma.toml anchored on the fixed prefix 5D 00 00 — props byte 0x5D only (lc3/lp0/pb2, the xz --format=lzma default). A legacy LZMA-alone stream built with any other (lc, lp, pb) was never fed to the validator and so was silently missed. The reported case: OpenWrt ath79 firmware (Archer C7 v2) carries its compressed Linux kernel at offset 0x200 with props 0x6D (lc1/lp2/pb2); binwalk detects it, moria did not. For a firmware-triage tool that is a bad failure mode — the highest-value component looks absent rather than undetected.

Fix (the issue's Option B — structural)

The validator was already props-agnostic. Its props <= 224 check is exactly the set of valid (lc<=8, lp<=4, pb<=4) byte values, and it trial-decodes to a clean end-of-stream marker before emitting — so false-positive safety never came from the anchor, only from the decode gate.

The matcher is literal (no wildcard/mask), so Option B is realized by widening the anchor to the format-invariant 00 00: the low 16 bits of the dict_size field, which are always zero because every real encoder uses a dict size that is a multiple of 64 KiB. magic_offset = 1 places the structure start on the props byte that precedes those two zero bytes. This is the same model the existing yaffs2 signature already uses with its common 0xFFFF anchor — a frequent pattern that the validator earns rather than the magic.

Signature plus two code comments only. No validator or decoder logic changed.

Verification

• OpenWrt 0x6D case now reported verified with correct size/dict.
• Corpus sweep over a broad firmware slice: 429 real LZMA findings vs 80 with the old anchor (+18 files), 0 crashes, 0 false positives — every new finding independently re-decodes as a valid LZMA-alone stream with a clean end-of-stream marker.
• Full test suite green; fuzz smoke clean; ASan/UBSan clean on the lzma path, the synthetic fixture, and every file that gained findings.
• Perf: about +10% (+0.7s) on a 273 MB worst-case image with large low-entropy regions; sub-0.15s delta on typical 8–64 MB firmware — the same tradeoff yaffs2's anchor already makes.
• New tests/test_lzma.py section covers props 0x6D/0x5A/0x5C/0xB8 identify at an offset plus byte-exact 0x6D extract, using Python's stdlib lzma (no external tool).