1. 1. What & why

The WASM (SpiderMonkey) sandbox executes arbitrary user-supplied JS and is treated as untrusted. `MozJSWasmBridge::_extractBSON` (`bridge.cpp`) wrapped the guest's `list<u8>` output in a `BSONObj` but only checked `BSONObj::isValid()`, which merely verifies the embedded 4-byte length header is within `(0, 125 MiB]` — it is never compared against the actual buffer size. It also gated minimum length with a fatal `invariant` (process abort).

This means a guest could return a small buffer whose forged length header (top-level or an inner string) points past the allocation, and downstream BSON readers would walk off the end of the buffer; the length floor was independently a process-abort lever.

1. 1. Changes

• Add `wasm_helpers::validatedBsonFromGuestBytes(data, size)` (`wasm_helpers.h` / `wasm_helpers.cpp`): copies the guest bytes into an owned `SharedBuffer` and runs `validateBSON(buf, size)` with the actual buffer size as `maxLength`, so any embedded length that would read past the allocation is rejected. Malformed or truncated input throws a `uassert` (`DBException`) instead of firing a fatal `invariant`.
• `MozJSWasmBridge::_extractBSON` now routes both the fast (`RAW_U8_LIST`) and slow (per-element) paths through this helper.
• `wasm/BUILD.bazel`: add `//src/mongo/bson:bson_validate` dependency to the `bridge` target.

1. 1. Safety / compatibility

• Validation uses `BSONValidateModeEnum::kDefault` (structural checks only), so well-formed guest output round-trips unchanged.
• Failures now surface as user-visible errors on the offending request rather than aborting `mongod`.

1. 1. Testing

`bazel test //src/mongo/scripting/mozjs/wasm:wasm_mozjs_test` — 159/159 pass, including 4 new `WasmValidatedBsonFromGuestBytes` cases: valid round-trip, forged oversized top-level header, forged inner string length, and truncated buffer.