fix: FindAll*/Search match-callback marshaling (crash, leak, struct-by-value)

[tinysec]

Summary

Three correctness bugs in the BinaryView search family, all surfaced by the exhaustive parity audit against the official Python binding. Each one crashed the process (AccessViolation) on the first match, so FindAllText / FindAllConstant were entirely unusable from C#.

1. Wrong delegate type — crash on first match

FindAllText and FindAllConstant both passed a 3-arg MatchDataDelegate thunk to core APIs whose native match callback has a different argument shape:

• BNFindAllTextWithProgress → bool(*)(ctxt, addr, const char* text, BNLinearDisassemblyLine* line) (4 args)
• BNFindAllConstantWithProgress → bool(*)(ctxt, addr, BNLinearDisassemblyLine* line) (3 args)

The thunk reinterpreted the wrong native pointer (text* or line* read as a BNDataBuffer*) and crashed. Each call is now wired to its matching MatchTextDelegate / MatchConstantDelegate. (Verified against binaryninjacore.h:4917.)

2. Struct passed by pointer instead of by value — crash while rendering

The generated P/Invokes declared their BNFunctionViewType parameter as in (by-ref), which marshals the by-value C struct as a pointer. The core read garbage type/name fields and crashed during linear disassembly. FindAllData was unaffected only because it takes no viewType. Dropped in across all 8 sites so the blittable struct is passed by value.

3. Null DisassemblySettings — crash

FindAllText/FindAllConstant forwarded a null settings as IntPtr.Zero, but the core dereferences the settings pointer while rendering. The official Python binding always builds a default DisassemblySettings; this now does the same (disposing only the one it allocates, never a caller-owned instance).

Plus: per-match ownership & GC rooting

• The match callback owns each matched BNDataBuffer / BNLinearDisassemblyLine (per Python's DataBuffer(handle=) __del__ and _LinearDisassemblyLine_convertor → BNFreeLinearDisassemblyLines). The MatchData thunk now takes (owns) the buffer; MatchText/MatchConstant thunks free the line after MustFromNativePointer copies it eagerly (freeing is safe). The earlier borrow / never-free forms leaked one object per match.
• Every match thunk is now rooted with GC.KeepAlive so a mid-scan GC cannot free it.
• The wrappers were converted from lambdas to named holder methods (no-lambda rule).

Verification

• Binding builds clean (0 warnings, 0 errors).
• New E2E parity tests in sharp-binaryninja-tests: FindAllData / FindAllText / FindAllConstant each drive the callback through ≥1 real match. All 28 harness tests pass (25 prior + 3 new), no regressions.
• Ground-truth checked against the official Python binding (find_all_text / find_all_constant succeed on the same cat.bndb).

Notes

• The in → by-value fix is in 8 generated Function/BN*.cs files. The generator should be updated to emit by-value struct params for BNFunctionViewType (and any other by-value structs) so this doesn't regress on regen.
• DisassemblySettings option parity (Python sets ShowAddress=False, ShowOpcode=False, etc.) is intentionally deferred — the core-default settings work; that's a rendering-preference refinement, not a correctness fix.