[JackyHsu-X]

Unpacker.read_bytes() does not reject negative lengths. The C extension raises an internal SystemError from PyBytes_FromStringAndSize; the Python implementation accepts the count and can return an unintended slice of buffered data.

Raise ValueError for a negative byte count before reading or updating the stream position in either implementation. Four regression cases cover feed-based and file-based unpackers with -1 and a larger negative count. They also check that the failed call leaves the position unchanged and that zero-length reads and subsequent reads/unpacking still work.

On Windows/Python 3.13, all four cases fail with each unchanged implementation. With the fix, the complete C-extension suite has 164 passed and 1 skipped; the Python suite has 161 passed and 4 skipped. Both retain three existing unknown-marker warnings for thread_unsafe when the free-threaded test plugin is absent. Repository-wide Ruff lint and format checks pass. Other OS/Python and free-threaded matrices were not run locally.

Related: #742 validates negative sizes in the packer header APIs; this change covers the unpacker's raw-byte reader. #752 concerns short feed-based reads, which is a separate case.

AI assistance: OpenAI Codex investigated, generated and self-reviewed the patch, and ran the local checks. No separate human review is claimed.