Headers claimed protections the code never had, and several destructive paths had no guard against a collapsed config value.