feat(variables): Begin reading minidump memory for variables

[Dav1dde]

Threads the minidump down to the variable extraction and implements a basic frame pointer offset resolution.

Obviously there is still a lot left to do, interpreting the memory based on the type etc, this is just threading down the minidump.

Note: This uses scroll version 0.12 instead of 0.12 because of the minidump crate.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fd3517f. Configure here.}

[sentry-warden]

Variable extraction materializes attacker-sized memory dumps without an output cap

When variable extraction is enabled, a SymCache-derived primitive or pointer size controls the minidump range read for a frame-offset variable. Although the memory accessor checks that the range exists, a successful range can be as large as the accepted dump and format!("{s:?}") materializes an uncapped, substantially larger String that is retained in the response, potentially exhausting worker memory.

Evidence

• /minidump and /symbolicate-any accept options.extract_variables; minidump processing passes Some(Arc::new(minidump)) as the memory source to native symbolication (crates/symbolicator/src/endpoints/minidump.rs:47-50, crates/symbolicator-native/src/symbolication/process_minidump.rs:672-676).
• resolve_variable_value obtains TypeSize::Bytes(size) from SymCache primitive/pointer types and uses that value for FrameOffset memory access (crates/symbolicator-native/src/symbolication/native.rs:212-215, 231-257); no application-level maximum is applied to size.
• get_memory_at_address safely rejects ranges beyond the mapped memory region, but a valid range may still span the dump's large memory region (crates/symbolicator-native/src/memory.rs:15-27). The fallback then Debug-formats every byte into an owned String with no output cap (crates/symbolicator-native/src/symbolication/native.rs:255-257), and the String is retained in the variables map at lines 185-195.
• The local minidump body limit is 250 MiB (crates/symbolicator-service/src/config.rs:663-665), which limits input bytes but not the formatted output or serialization work; the remote attachment path additionally streams the storage response without applying that limit (crates/symbolicator-native/src/symbolication/attachments.rs:36-52).

Also found at 1 additional location

• crates/symbolicator-native/src/symbolication/native.rs:256-258

_{Identified by Warden · wrdn-dos-review · 88N-CRQ}