Function read_fd_to_end_capped 

pub(crate) fn read_fd_to_end_capped(
    fd: &OwnedFd,
    idle: Duration,
    cap: usize,
) -> Result<Vec<u8>, String>

Same as read_fd_to_end but refuses a source larger than cap.

cap is inclusive: a payload of exactly cap bytes is accepted. The limit is therefore tested against the size this chunk would produce, before appending — a test on the already-accumulated length is reached again before EOF can be observed, so it would reject a payload that exactly fills the cap.