BsonBinarySubType is an int-backed enum with no range check, so a value like 260 is accepted byBsonBinaryData and by JsonReader (BinData(), HexData(), legacy $type), then truncated to its low byte by WriteBinarySubType. The result is a stored binary value whose subtype byte does not match its contents: unreadable documents, silent 4-byte truncation, or a subtype that bypasses application-level checks.

Fixes:

• BsonBinaryData constructor rejects a subtype outside 0-255.
• JsonReader rejects it with FormatException in all forms (BinData, HexData, legacy $type).
• WriteBinarySubType throws instead of masking.
• JsonWriter no longer emits a subType its own reader rejects.

This is on both 3.x and 2.x