#32993 fuzz: wallet: add target for tx scanning

• Catch crashes and edge cases in wallet transaction scanning using fuzzed block inputs
• Protect wallet rescan logic against complex state transitions missed by deterministic tests

This pull request introduces a new fuzz target, `wallet_scan`, testing `ScanForWalletTransactions` under various block and block filter index configurations. It constructs fuzzed blocks and transactions to exercise the wallet's rescan and reservation logic.

Problem: Wallet transaction scanning and block filter interactions have complex state transitions and edge cases that are not fully exercised by deterministic unit and functional tests, creating potential unhandled crashes.

P3 · test coverage

• P3 because it expands fuzz coverage to discover crashes in wallet rescanning
• It provides automated regression defense without resolving an active vulnerability

The PR expands fuzz coverage for wallet transaction rescanning as part of tracking issue #29901. It does not directly fix a known vulnerability or reproducer.

Membership: Adds a new fuzz harness target (`wallet_scan`) under the fuzz test suite.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 1

P3 · test coverage

• P3 because it strengthens test coverage for wallet fund tracking and block processing
• The safety benefits apply to rescan logic without altering any production code

Adding automated fuzzing for wallet rescans provides useful regression defense for wallet fund tracking and block processing, but touches no production wallet code.

Membership: Exercises `ScanForWalletTransactions` and `WalletRescanReserver` in `src/wallet/test/fuzz/scan.cpp`.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 1

• Author moved the PR to draft to refactor for execution speed and has been inactive
• Hold review until the author pushes the updated harness and takes it out of draft

The author moved the PR to draft to refactor the harness for better exec/s performance and has been silent for 96 days.

Author status: silent since 2026-06-12 after moving the PR to draft to refactor for execution speed

Resolved concerns:

• fanquake pointed out a signed-integer overflow UBSan failure in the chrono mock time callback, which was fixed by the author.
• ekzyis reported an ASan heap-use-after-free when block filter indexes were not cleaned up at the end of an iteration, which the author resolved by unconditionally calling DestroyAllBlockFilterIndexes.

• General positive reception with no architectural objections
• Verified the harness runs without crashing (Chand-ra)
• Fixed a cleanup memory leak found during review (ekzyis)
• Fixed an integer overflow in the mock time helper (fanquake)

Positive; initial sanitizer findings were resolved and the target received a tACK before the author drafted it for speed improvements

All feedback from reviewers was incorporated cleanly, and no architectural or design objections were raised.

• fanquake reported a UBSan failure in CI, which the author resolved
• Chand-ra left a tACK confirming the target runs without crashing
• ekzyis identified an ASan leak on cleanup, which the author fixed

Review verdicts (DrahtBot): 0 (+1)

• Stale ACK: Chand-ra

111 lines under test/bench/ci.

• src/wallet/test/fuzz/scan.cpp +110/-0
• src/wallet/test/fuzz/CMakeLists.txt +1/-0

This PR adds a new fuzz harness (`wallet_scan`) testing `CWallet::ScanForWalletTransactions` across varied block structures and block filter index setups. It expands coverage under tracking issue #29901 to catch subtle rescan crashes and invariants. Reviewers verified the harness and resolved initial sanitizer issues. The PR is paused in draft while the author plans to refactor the harness to improve execution speed.