From 4aa4b899cb135ff90f433998d3d42b0c1429600e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Thu, 2 Jul 2026 22:38:51 -0400
Subject: [PATCH 01/13] policy: count bare data envelopes (OP_2DROP/pushnum
 runs) as datacarrier

---
 src/script/script.cpp     | 9 +++++----
 src/test/script_tests.cpp | 4 ++++
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/script/script.cpp b/src/script/script.cpp
index fbb52fee7f9b..74b82305f98d 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -372,6 +372,7 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
     opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
     std::vector<unsigned char> push_data;
     unsigned int inside_noop{0}, inside_conditional{0};
+    auto is_push = [](opcodetype op) { return op <= OP_16 && op != OP_RESERVED; };  // OP_0..OP_16 push data/numbers
     CScript::const_iterator opcode_it = begin(), data_began = begin();
     for (CScript::const_iterator it = begin(); it < end(); last_opcode = opcode) {
         opcode_it = it;
@@ -406,10 +407,10 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
         } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
             inside_noop = 1;
             data_began = opcode_it;
-        // Match <data> OP_DROP
-        } else if (opcode <= OP_PUSHDATA4) {
-            data_began = opcode_it;
-        } else if (opcode == OP_DROP && last_opcode <= OP_PUSHDATA4) {
+        // Match <data> OP_DROP, or a run of <data>/pushnums ... OP_DROP/OP_2DROP (bare/BIP-110 envelope)
+        } else if (is_push(opcode)) {
+            if (!is_push(last_opcode)) data_began = opcode_it;  // only reset at the start of a push run
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && is_push(last_opcode)) {
             counted += it - data_began;
         }
     }
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 4b9ae35722a2..22b579a1e02e 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1525,6 +1525,10 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_TRUE << OP_IF << OP_ENDIF << OP_ENDIF));
     // pushing then immediately dropping is data: length(1), zero(11), OP_DROP
     BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP));
+    // bare/BIP-110 envelope: a run of pushes balanced by OP_2DROP is all data
+    BOOST_CHECK_EQUAL("0+25", DatacarrierBytesStr(CScript() << zeros(11) << zeros(11) << OP_2DROP));
+    // pushnums interleaved in the run don't strand earlier pushes: 12 + 1 (OP_7) + 12 + 1 (OP_2DROP)
+    BOOST_CHECK_EQUAL("0+26", DatacarrierBytesStr(CScript() << zeros(11) << OP_7 << zeros(11) << OP_2DROP));
     // OLGA data obfuscated as p2wsh
     const auto olga_header = CScript() << OP_0 << "003e7374616d703a000000000000000000000000000000000000000000000000"_hex;
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 2));

From e13330128567a1fb20efd2b74006b9256cd2b495 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Thu, 2 Jul 2026 22:38:51 -0400
Subject: [PATCH 02/13] test: functional coverage for bare datacarrier
 envelopes

---
 test/functional/mempool_datacarrier.py | 56 ++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/test/functional/mempool_datacarrier.py b/test/functional/mempool_datacarrier.py
index 540597199994..ffad09a90348 100755
--- a/test/functional/mempool_datacarrier.py
+++ b/test/functional/mempool_datacarrier.py
@@ -15,6 +15,7 @@
     CScript,
     OP_1,
     OP_2DROP,
+    OP_7,
     OP_DROP,
     OP_RETURN,
     taproot_construct,
@@ -92,6 +93,50 @@ def test_opnet_transaction(self, node: TestNode, success: bool) -> None:
                                     self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
 
+    def test_bare_envelope(self, node: TestNode, data_len: int, success: bool, interleave_pushnum: bool = False) -> None:
+        # A bare inscription envelope: <marker> <data>... balanced by OP_2DROP,
+        # with no OP_IF wrapper (the shape ordinals/ord#4545 uses under BIP-110).
+        # A pushnum interleaved in the run (which ord's parser accepts as payload)
+        # must not strand the large push from datacarrier counting.
+        if interleave_pushnum:
+            envelope_script = CScript([randbytes(data_len), OP_7, randbytes(1), OP_2DROP, OP_DROP, OP_1])
+        else:
+            envelope_script = CScript([b'ord', randbytes(data_len), OP_2DROP, OP_1])
+        internal_key = b'\x01' * 32
+        tap = taproot_construct(internal_key, [("leaf", envelope_script), ("dummy", CScript([OP_1]))])
+        leaf = tap.leaves["leaf"]
+        control_block = bytes([leaf.version | tap.negflag]) + tap.internal_pubkey + leaf.merklebranch
+        assert len(control_block) == 65
+
+        utxo = self.wallet.get_utxo()
+        funding_tx = CTransaction()
+        funding_tx.vin = [CTxIn(COutPoint(int(utxo['txid'], 16), utxo['vout']))]
+        funding_value = int(utxo['value'] * 100_000_000) - 1000
+        funding_tx.vout = [CTxOut(funding_value, tap.scriptPubKey)]
+        funding_tx.version = 2
+        self.wallet.sign_tx(funding_tx)
+        funding_tx.rehash()
+        self.nodes[0].sendrawtransaction(funding_tx.serialize().hex())
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(funding_tx.hash, 16), 0))]
+        spend_tx.vout = [CTxOut(funding_value - 1000, tap.scriptPubKey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness()]
+        spend_tx.wit.vtxinwit[0].scriptWitness.stack = [
+            bytes(envelope_script),  # tapscript
+            control_block,           # control block (65 bytes)
+        ]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
+
     def run_test(self):
         self.wallet = MiniWallet(self.nodes[0])
 
@@ -141,6 +186,17 @@ def run_test(self):
         self.log.info("Testing an OPNet transaction (just pushing 'op') with -datacarriersize=2.")
         self.test_opnet_transaction(node=self.nodes[3], success=False)
 
+        self.log.info("Testing a bare OP_2DROP envelope larger than the default -datacarriersize.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False)
+
+        self.log.info("Testing a bare OP_2DROP envelope smaller than the default -datacarriersize.")
+        # data_len >= 2 keeps the payload a minimal push; a 1-byte push of 1..16 or 0x81 would be
+        # rejected by MINIMALDATA in script verification rather than accepted by the datacarrier check.
+        self.test_bare_envelope(node=self.nodes[0], data_len=2, success=True)
+
+        self.log.info("Testing a bare envelope with a pushnum interleaved in the push run.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False, interleave_pushnum=True)
+
 
 if __name__ == '__main__':
     DataCarrierTest(__file__).main()

From 6507ed3e75a05ad1f54884f3d0a69c70bb4decca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Wed, 30 Sep 2026 16:41:35 -0400
Subject: [PATCH 03/13] test: the 30 kB no-op leaf is a data envelope under the
 new run rule

---
 test/functional/feature_taproot.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 7e00ff083525..60afe2c0b553 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -1037,8 +1037,10 @@ def big_spend_inputs(ctx):
     add_spender(spenders, "tapscript/emptysigs/checksig", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t13"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/nochecksigverify", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t20"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/checksigadd", leaf="t14", **common, inputs=[b'', getter("sign")], failure={"leaf": "t15"}, **ERR_UNKNOWN_PUBKEY)
-    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable.
-    add_spender(spenders, "tapscript/no10000limit", leaf="t19", **SINGLE_SIG, **common)
+    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable by consensus.
+    # The leaf opens with 10001 repeats of OP_0 OP_0 OP_2DROP, which datacarrier policy counts as
+    # a data envelope, so it is only spendable in a block rather than through the mempool.
+    add_spender(spenders, "tapscript/no10000limit", leaf="t19", standard=False, **SINGLE_SIG, **common)
     # Test that a stack size of 1000 elements is permitted, but 1001 isn't.
     add_spender(spenders, "tapscript/1000stack", leaf="t21", **SINGLE_SIG, **common, failure={"leaf": "t22"}, **ERR_STACK_SIZE)
     # Test that an input stack size of 1000 elements is permitted, but 1001 isn't.

From 5e3153edef46f36565ee608a1826fe3bf0d5ecd6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Sun, 4 Oct 2026 21:11:55 -0400
Subject: [PATCH 04/13] test: keep the sigops ratio script 2 push under the
 datacarrier limit

---
 test/functional/feature_taproot.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 60afe2c0b553..1651179452cc 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -1063,7 +1063,7 @@ def big_spend_inputs(ctx):
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGVERIFY.
         lambda n, pk: (CScript([OP_DROP, pk, OP_0, OP_IF, OP_2DUP, OP_CHECKSIGVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_2, OP_SWAP, OP_CHECKSIGADD, OP_3, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIG.
-        lambda n, pk: (CScript([random.randbytes(220), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
+        lambda n, pk: (CScript([random.randbytes(75), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGADD.
         lambda n, pk: (CScript([OP_DROP, pk, OP_1, OP_IF, OP_ELSE, OP_2DUP, OP_6, OP_SWAP, OP_CHECKSIGADD, OP_7, OP_EQUALVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_8, OP_SWAP, OP_CHECKSIGADD, OP_9, OP_EQUAL]), n + 1),
         # n+1 OP_CHECKSIGs, but also one OP_CHECKSIG with an empty signature.

From 55ca8414ae8a39051405f394912ff8ff8eabddd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Sun, 4 Oct 2026 19:04:52 -0400
Subject: [PATCH 05/13] policy: count pubkeys no signature can prove as
 datacarrier bytes

---
 src/script/script.cpp | 133 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 132 insertions(+), 1 deletion(-)

diff --git a/src/script/script.cpp b/src/script/script.cpp
index 74b82305f98d..44da23c8ba16 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -8,10 +8,12 @@
 #include <crypto/common.h>
 #include <crypto/hex_base.h>
 #include <hash.h>
+#include <pubkey.h>
 #include <script/interpreter.h>
 #include <uint256.h>
 #include <util/hash_type.h>
 
+#include <algorithm>
 #include <string>
 
 CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
@@ -356,6 +358,135 @@ size_t CScript::OPNetWitnessSize(const CScriptWitness& witness) const
     return stack[0].size() + stack[3].size() - deduct;
 }
 
+/** Value of OP_1..OP_16, or -1 for any other opcode. CScript::DecodeOP_N asserts instead. */
+static int SmallIntValue(const opcodetype opcode)
+{
+    if (opcode < OP_1 || opcode > OP_16) return -1;
+    return int{opcode} - int{OP_1 - 1};
+}
+
+/** The m or n of an m-of-n, which above 16 is a minimal one byte push rather than an OP_N. */
+static int MultisigCount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode == 1 && push_data.size() == 1 && push_data[0] > 16 && push_data[0] <= MAX_PUBKEYS_PER_MULTISIG) {
+        return push_data[0];
+    }
+    return -1;
+}
+
+static bool IsPubkeyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (opcode > OP_PUSHDATA4) return false;
+    return push_data.size() == CPubKey::COMPRESSED_SIZE || push_data.size() == CPubKey::SIZE;
+}
+
+/** Mirror of the push run the caller counts when it is balanced by a drop. */
+static bool IsRunPush(const opcodetype opcode)
+{
+    return opcode <= OP_16 && opcode != OP_RESERVED;
+}
+
+/**
+ * Signature-shaped witness items: a DER signature plus its sighash byte, or a BIP340 one.
+ *
+ * The last item is the script or the control block of the spend, never a signature.
+ */
+static size_t CountWitnessSignatures(const CScriptWitness& witness)
+{
+    size_t count{0};
+    for (size_t i{0}; i + 1 < witness.stack.size(); ++i) {
+        const size_t size{witness.stack[i].size()};
+        if (size >= 64 && size <= 73) ++count;
+    }
+    return count;
+}
+
+/**
+ * Bytes a script carries in pubkeys that no signature can prove.
+ *
+ * A key in an m-of-n that nothing signs for authorizes nothing, so what it holds is payload
+ * rather than a spending condition. That is how a file is published as a chain of ground
+ * secp256k1 points, each carrying 31 bytes and hiding behind a hash until it is spent. Ordinary
+ * multisig carries a couple of such keys itself, hence the tolerance.
+ */
+static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* witness)
+{
+    /** Unproven pubkeys a script may carry before the rest are counted as data. Set so that ordinary
+     *  multisig, including wide federations, is charged nothing at all: the budget is per
+     *  transaction, so any per-input charge accumulates across inputs and would reject real spends. */
+    static constexpr size_t MAX_UNPROVEN_PUBKEYS{10};
+
+    size_t pubkeys{0}, provable{0};
+    // The current run of adjacent pubkey pushes, and the count that opened it. A well-formed
+    // m-of-n closes as <m> <pubkey>*n <n> OP_CHECKMULTISIG, and only that shape credits m.
+    size_t run_keys{0};
+    // Keys in the current push run, which the caller counts whole if a drop balances it.
+    size_t push_run_keys{0};
+    int run_opened_by{-1}, last_count{-1};
+    unsigned int inside_noop{0};
+    bool last_is_push{false};
+    opcodetype opcode{OP_INVALIDOPCODE}, last_opcode{OP_INVALIDOPCODE};
+    std::vector<unsigned char> push_data;
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        // The caller counts an unparsable script whole, and the iterator may not have advanced.
+        if (!script.GetOp(it, opcode, push_data)) return 0;
+        const bool is_pubkey{IsPubkeyPush(opcode, push_data)};
+        const int count{MultisigCount(opcode, push_data)};
+
+        if (inside_noop) {
+            // A closed OP_FALSE OP_IF envelope is counted whole by the caller, so skip over it.
+            if (opcode == OP_IF || opcode == OP_NOTIF) {
+                ++inside_noop;
+            } else if (opcode == OP_ENDIF) {
+                --inside_noop;
+            }
+        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+            inside_noop = 1;
+        } else if (is_pubkey) {
+            if (!run_keys) run_opened_by = last_count;
+            ++run_keys;
+            ++push_run_keys;
+            ++pubkeys;
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && last_is_push) {
+            // The caller counts the whole run as dropped data, so do not charge it again.
+            pubkeys -= push_run_keys;
+            run_keys = 0;
+        } else if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY) {
+            ++provable;
+            run_keys = 0;
+        } else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY) {
+            // Padding or reordering the keys forfeits the credit rather than earning one.
+            if (run_opened_by > 0 && last_count > 0 && size_t(last_count) == run_keys) {
+                provable += size_t(run_opened_by);
+            }
+            run_keys = 0;
+        } else if (count < 0) {
+            // A key count sits on both ends of a multisig, so it does not break the run.
+            run_keys = 0;
+        }
+
+        const bool is_push{IsRunPush(opcode)};
+        if (!is_push) push_run_keys = 0;
+        last_opcode = opcode;
+        last_count = count;
+        last_is_push = is_push;
+    }
+
+    // A script can name more signatures than the spender supplies, including in branches that
+    // never run. Where the witness carries the spend it is the honest count; a P2SH spend leaves
+    // its signatures in the scriptSig, which is not visible here.
+    if (witness && !witness->stack.empty()) {
+        provable = std::min(provable, CountWitnessSignatures(*witness));
+    }
+
+    if (pubkeys < provable + MAX_UNPROVEN_PUBKEYS) return 0;
+    // An uncompressed key carries no more payload than a compressed one, since only the x
+    // coordinate is free, so the compressed size is the unit.
+    return (pubkeys - provable - MAX_UNPROVEN_PUBKEYS) * CPubKey::COMPRESSED_SIZE;
+}
+
 std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness) const
 {
     if (size_t olga_bytes = IsOLGA(remaining_outputs); olga_bytes) {
@@ -414,7 +545,7 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
             counted += it - data_began;
         }
     }
-    return {0, counted};
+    return {UnprovenPubkeyBytes(*this, witness), counted};
 }
 
 bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator end, opcodetype& opcodeRet, std::vector<unsigned char>* pvchRet)

From f2e7e09d910c33755ff1e37f0bc72356904c0431 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Sun, 4 Oct 2026 19:04:53 -0400
Subject: [PATCH 06/13] test: coverage for unproven pubkey datacarrier counting

---
 src/test/fuzz/script.cpp               |   8 ++
 src/test/script_tests.cpp              | 103 +++++++++++++++++++++++++
 test/functional/mempool_datacarrier.py |  68 ++++++++++++++++
 3 files changed, 179 insertions(+)

diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index 07a49e039fb8..00aa961b0ea1 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -93,6 +93,14 @@ FUZZ_TARGET(script, .init = initialize_script)
     std::vector<std::vector<unsigned char>> solutions;
     (void)Solver(script, solutions);
 
+    {
+        CScriptWitness witness;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            witness.stack.push_back(ConsumeRandomLengthByteVector(fuzzed_data_provider));
+        }
+        (void)script.DatacarrierBytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4),
+                                      witness.stack.empty() ? nullptr : &witness);
+    }
     (void)script.HasValidOps();
     (void)script.IsPayToAnchor();
     (void)script.IsPayToScriptHash();
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 22b579a1e02e..ab65cc4ccf06 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1503,6 +1503,35 @@ static std::string DatacarrierBytesStr(const CScript &script, const size_t remai
     return strprintf("%s+%s", dcb.first, dcb.second);
 }
 
+static std::string DatacarrierBytesStr(const CScript& script, const CScriptWitness& witness)
+{
+    auto dcb = script.DatacarrierBytes(0, &witness);
+    return strprintf("%s+%s", dcb.first, dcb.second);
+}
+
+/** <m> <pubkey>*n <n> OP_CHECKMULTISIG, with distinct keys of the given size. */
+static CScript MultisigScript(const int m, const int n, const size_t key_size = 33)
+{
+    // CScript's operator<< encodes an int above 16 as a minimal push, as a real multisig does.
+    CScript script{CScript() << m};
+    for (int i{0}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, i + 1);
+    }
+    return script << n << OP_CHECKMULTISIG;
+}
+
+/** A witness offering sigs signatures, as a spend of the given script would. */
+static CScriptWitness MultisigWitness(const int sigs, const CScript& script)
+{
+    CScriptWitness witness;
+    witness.stack.emplace_back(); // the CHECKMULTISIG dummy
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(72, i + 1);
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    return witness;
+}
+
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
 {
     using zeros = std::vector<unsigned char>;
@@ -1538,6 +1567,80 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 3));
 }
 
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // A key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(33) << OP_CHECKSIG));
+    // Ordinary multisig is charged nothing, however wide, because the budget is per transaction
+    // and any per-input charge would accumulate across the inputs of a real spend
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 6)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 9)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(11, 15)));
+    // Above 16 the key count is a minimal one byte push rather than an OP_N, and still counts
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(17, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(20, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(19, 20)));
+    // The boundary: eleven keys behind one signature is free, twelve starts paying
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 11)));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultisigScript(1, 12)));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15)));
+    // Uncompressed keys carry no more payload, so they are charged the same
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15, 65)));
+
+    // Naming signatures the spend does not offer earns nothing: OP_CHECKSIG in a branch that
+    // never runs would otherwise buy off the whole count for one byte each
+    CScript evasion{MultisigScript(1, 15)};
+    evasion << OP_IF << OP_1 << OP_ELSE;
+    for (int i{0}; i < 15; ++i) {
+        evasion << OP_CHECKSIG;
+    }
+    evasion << OP_ENDIF;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(evasion));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(evasion, MultisigWitness(1, evasion)));
+    // A real 11-of-15 spend is charged nothing whether or not the witness is seen
+    const CScript multisig{MultisigScript(11, 15)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, MultisigWitness(11, multisig)));
+    // An empty witness means the signatures are elsewhere (P2SH), so the script is believed
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, CScriptWitness()));
+    // The witnessScript itself is not a signature, however close to one in size
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(0, MultisigScript(1, 15))));
+    // ... whereas offering one signature for the same script leaves fourteen keys unproven
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(multisig, MultisigWitness(1, multisig)));
+
+    // Breaking the key run forfeits the m credit rather than earning one
+    CScript padded{CScript() << OP_1};
+    for (int i{0}; i < 15; ++i) {
+        padded << zeros(33) << OP_NOP;
+    }
+    padded << CScript::EncodeOP_N(15) << OP_CHECKMULTISIG;
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(padded));
+
+    // A dropped key is already counted as dropped data; it is not charged twice
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(33) << OP_DROP));
+    // A drop balancing the run discounts every key in it, whatever sits at the end of the run
+    BOOST_CHECK_EQUAL("0+105", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33) << 20 << OP_DROP));
+    BOOST_CHECK_EQUAL("0+36", DatacarrierBytesStr(CScript() << zeros(33) << OP_1 << OP_DROP));
+    // Keys inside an OP_FALSE OP_IF envelope are counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33) << OP_ENDIF));
+    // An envelope that never closes is counted by neither rule. It cannot execute, so it is
+    // unspendable as a witness or redeem script and nonstandard as a scriptPubKey.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33)
+                                                           << zeros(33) << zeros(33)));
+    // A bare envelope carries no pubkeys at all, so this rule must charge nothing for it
+    BOOST_CHECK_EQUAL("0+90", DatacarrierBytesStr(CScript() << std::vector<unsigned char>{'o', 'r', 'd'}
+                                                            << zeros(83) << OP_2DROP << OP_1));
+    // A run of keys balanced by drops is counted as dropped data, so it is not charged again
+    BOOST_CHECK_EQUAL("0+171", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33)
+                                                             << zeros(33) << zeros(33)
+                                                             << OP_2DROP << OP_2DROP << OP_DROP));
+}
+
 BOOST_AUTO_TEST_CASE(script_GetScriptForTransactionInput)
 {
     using zeros = std::vector<unsigned char>;
diff --git a/test/functional/mempool_datacarrier.py b/test/functional/mempool_datacarrier.py
index ffad09a90348..3b945f693528 100755
--- a/test/functional/mempool_datacarrier.py
+++ b/test/functional/mempool_datacarrier.py
@@ -3,6 +3,7 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 """Test datacarrier functionality"""
+from test_framework.key import ECKey
 from test_framework.messages import (
     COutPoint,
     CTransaction,
@@ -16,10 +17,14 @@
     OP_1,
     OP_2DROP,
     OP_7,
+    OP_CHECKMULTISIG,
     OP_DROP,
     OP_RETURN,
+    SIGHASH_ALL,
+    SegwitV0SignatureHash,
     taproot_construct,
 )
+from test_framework.script_util import script_to_p2wsh_script
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.test_node import TestNode
 from test_framework.util import assert_raises_rpc_error
@@ -92,6 +97,46 @@ def test_opnet_transaction(self, node: TestNode, success: bool) -> None:
             assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
                                     self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
+    def test_unproven_pubkeys_transaction(self, node: TestNode, m: int, n: int, success: bool,
+                                          num_inputs: int = 1) -> None:
+        """Spend num_inputs m-of-n P2WSH multisig outputs, offering every signature each asks for.
+
+        The n - m keys left over are ones no signature can prove, and past a small tolerance
+        their bytes are payload rather than a spending condition. The tolerance is per script,
+        so several wide multisig inputs in one transaction do add up.
+        """
+        keys = []
+        for _ in range(n):
+            key = ECKey()
+            key.generate(compressed=True)
+            keys.append(key)
+        # Above 16 a key count is a minimal push rather than an OP_N, which CScript handles.
+        script = CScript([m] + [k.get_pubkey().get_bytes() for k in keys] + [n, OP_CHECKMULTISIG])
+        script_pubkey = script_to_p2wsh_script(script)
+
+        funding_value = 100_000
+        funding = [self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_pubkey,
+                                       amount=funding_value) for _ in range(num_inputs)]
+        self.generate(self.wallet, 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(f['txid'], 16), f['sent_vout'])) for f in funding]
+        spend_tx.vout = [CTxOut(funding_value * num_inputs - 10000, script_pubkey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness() for _ in funding]
+        for i in range(num_inputs):
+            sighash = SegwitV0SignatureHash(script, spend_tx, i, SIGHASH_ALL, funding_value)
+            sigs = [k.sign_ecdsa(sighash) + bytes([SIGHASH_ALL]) for k in keys[:m]]
+            # The leading empty item is the CHECKMULTISIG dummy.
+            spend_tx.wit.vtxinwit[i].scriptWitness.stack = [b''] + sigs + [bytes(script)]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
     def test_bare_envelope(self, node: TestNode, data_len: int, success: bool, interleave_pushnum: bool = False) -> None:
         # A bare inscription envelope: <marker> <data>... balanced by OP_2DROP,
@@ -197,6 +242,29 @@ def run_test(self):
         self.log.info("Testing a bare envelope with a pushnum interleaved in the push run.")
         self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False, interleave_pushnum=True)
 
+        self.log.info("Testing ordinary multisig, which is charged nothing however wide.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=3, n=5, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=6, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=11, n=15, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=14, n=17, success=True)
+        # Several inputs of the same shape, since the budget is per transaction
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=5, success=True, num_inputs=3)
+
+        self.log.info("Testing a multisig padded out with keys no signature can prove.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=11, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=15, success=False)
+
+        self.log.info("Testing that -datacarriersize governs the spare keys, and that multisig "
+                      "with nothing to spare is unaffected by it.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=1, n=12, success=False)
+
+        self.log.info("Testing that what is charged is charged per script, so it adds up over "
+                      "the inputs of a transaction.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=True, num_inputs=2)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=False, num_inputs=3)
+
 
 if __name__ == '__main__':
     DataCarrierTest(__file__).main()

From cd8907ec48414b2248bec6bbb2517e3f7169eb25 Mon Sep 17 00:00:00 2001
From: LionThunderFingers
 <42521162+LionThunderFingers@users.noreply.github.com>
Date: Sat, 10 Oct 2026 17:30:56 +0200
Subject: [PATCH 07/13] policy: count tapscript pubkeys no signature can prove
 as datacarrier bytes

The rule only recognised a key in a 33 or 65 byte push, so the same payload
written as tapscript went free: a 1-of-15 costs 132 datacarrier bytes under
P2WSH and nothing at all under a taproot leaf, for 32 bytes of publishable
space per key rather than 31.

A 32 byte push is not a key on sight, since nothing separates an x-only key
from a hash until something spends it. Count it where a checksig-family
opcode claims it instead, which leaves the preimage of a hashlock alone.

OP_CHECKSIGADD is how tapscript writes an m-of-n, so credit its canonical
shape as OP_CHECKMULTISIG's is already credited: a run of

  <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)* <k> OP_NUMEQUAL

credits k, whatever size its keys are. Without it every honest tapscript
multisig past eleven keys would be charged for the keys it does not spend,
which is the opposite of the point: a 20-of-20 would cost 297 bytes. The
OP_CHECKSIG that opens the run has credited one of the k already, so only
the remaining k-1 are added there.

Padding the run, reordering it or naming a k it cannot satisfy forfeits the
credit rather than earning one, so working around the rule raises the charge
instead of lowering it. An opcode that leaves the stack as it found it does
not hide the key beneath it from the opcode that spends it, so it does not
buy the count off either.
---
 src/script/script.cpp | 85 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 84 insertions(+), 1 deletion(-)

diff --git a/src/script/script.cpp b/src/script/script.cpp
index 44da23c8ba16..3a0f0fc92abb 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -375,12 +375,44 @@ static int MultisigCount(const opcodetype opcode, const std::vector<unsigned cha
     return -1;
 }
 
+/**
+ * The k of a tapscript k-of-n, which allows far more keys than OP_CHECKMULTISIG does.
+ *
+ * A k from 1 to 16 is an OP_N as usual. Beyond the range OP_N reaches, k is instead a minimal
+ * push of the number: one byte up to 127, two beyond that, since a third would only ever hold
+ * the sign of a count that cannot be negative.
+ */
+static int MultiACount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode != 1 && opcode != 2) return -1;
+    if (push_data.size() != static_cast<size_t>(opcode)) return -1;
+    // A minimal push carries no redundant high byte, and the sign bit is never set here.
+    if (push_data.back() == 0 || (push_data.back() & 0x80)) return -1;
+    int value{push_data[0]};
+    if (push_data.size() == 2) value |= int{push_data[1]} << 8;
+    if (value <= 16 || value > int{MAX_PUBKEYS_PER_MULTI_A}) return -1;
+    return value;
+}
+
 static bool IsPubkeyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
 {
     if (opcode > OP_PUSHDATA4) return false;
     return push_data.size() == CPubKey::COMPRESSED_SIZE || push_data.size() == CPubKey::SIZE;
 }
 
+/** A 32 byte push, which is an x-only key where a checksig-family opcode claims it as one. */
+static bool IsXOnlyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    return opcode <= OP_PUSHDATA4 && push_data.size() == XOnlyPubKey::size();
+}
+
+/** Opcodes that leave the stack as they found it, so the key below them is still on top. */
+static bool IsStackNeutralNop(const opcodetype opcode)
+{
+    return opcode == OP_NOP || (opcode >= OP_NOP1 && opcode <= OP_NOP10);
+}
+
 /** Mirror of the push run the caller counts when it is balanced by a drop. */
 static bool IsRunPush(const opcodetype opcode)
 {
@@ -423,9 +455,15 @@ static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* w
     size_t run_keys{0};
     // Keys in the current push run, which the caller counts whole if a drop balances it.
     size_t push_run_keys{0};
-    int run_opened_by{-1}, last_count{-1};
+    // The current run of a tapscript k-of-n, which names its keys one at a time as
+    // <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)* <k> OP_NUMEQUAL. Only that shape credits k.
+    size_t multi_a_keys{0};
+    int run_opened_by{-1}, last_count{-1}, last_a_count{-1};
     unsigned int inside_noop{0};
     bool last_is_push{false};
+    // Whether the item before this one was a key a checksig-family opcode can still claim, and
+    // whether it was the 32 byte kind that is only a key because one does.
+    bool last_is_key{false}, last_is_xonly{false};
     opcodetype opcode{OP_INVALIDOPCODE}, last_opcode{OP_INVALIDOPCODE};
     std::vector<unsigned char> push_data;
 
@@ -433,7 +471,10 @@ static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* w
         // The caller counts an unparsable script whole, and the iterator may not have advanced.
         if (!script.GetOp(it, opcode, push_data)) return 0;
         const bool is_pubkey{IsPubkeyPush(opcode, push_data)};
+        const bool is_xonly{IsXOnlyPush(opcode, push_data)};
         const int count{MultisigCount(opcode, push_data)};
+        const int a_count{MultiACount(opcode, push_data)};
+        bool is_key{false};
 
         if (inside_noop) {
             // A closed OP_FALSE OP_IF envelope is counted whole by the caller, so skip over it.
@@ -449,34 +490,76 @@ static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* w
             ++run_keys;
             ++push_run_keys;
             ++pubkeys;
+            is_key = true;
+        } else if (is_xonly) {
+            // Nothing tells an x-only key from a hash but the opcode that spends it, so this
+            // one is counted where a checksig-family opcode claims it rather than here. It
+            // stays out of the push run for the same reason: a drop never reaches it.
+            run_keys = 0;
+            is_key = true;
         } else if ((opcode == OP_DROP || opcode == OP_2DROP) && last_is_push) {
             // The caller counts the whole run as dropped data, so do not charge it again.
             pubkeys -= push_run_keys;
             run_keys = 0;
+            multi_a_keys = 0;
         } else if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY) {
+            if (last_is_xonly) ++pubkeys;
             ++provable;
             run_keys = 0;
+            // <pubkey> OP_CHECKSIG opens a tapscript k-of-n; anything else there ends one.
+            multi_a_keys = (last_is_key && opcode == OP_CHECKSIG) ? 1 : 0;
+        } else if (opcode == OP_CHECKSIGADD) {
+            if (last_is_xonly) ++pubkeys;
+            // The run is credited the k it closes on, so a key earns nothing on its own here.
+            multi_a_keys = (multi_a_keys && last_is_key) ? multi_a_keys + 1 : 0;
+            run_keys = 0;
+        } else if ((opcode == OP_NUMEQUAL || opcode == OP_NUMEQUALVERIFY) && multi_a_keys) {
+            // Padding or reordering the keys forfeits the credit rather than earning one, and
+            // so does naming a k the run cannot satisfy. The OP_CHECKSIG that opened the run
+            // has credited one of the k already.
+            if (last_a_count > 0 && size_t(last_a_count) <= multi_a_keys) {
+                provable += size_t(last_a_count) - 1;
+            }
+            multi_a_keys = 0;
+            run_keys = 0;
         } else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY) {
             // Padding or reordering the keys forfeits the credit rather than earning one.
             if (run_opened_by > 0 && last_count > 0 && size_t(last_count) == run_keys) {
                 provable += size_t(run_opened_by);
             }
             run_keys = 0;
+            multi_a_keys = 0;
         } else if (count < 0) {
             // A key count sits on both ends of a multisig, so it does not break the run.
             run_keys = 0;
+            if (a_count < 0) multi_a_keys = 0;
         }
 
         const bool is_push{IsRunPush(opcode)};
         if (!is_push) push_run_keys = 0;
+        // An opcode that leaves the stack as it found it leaves the key below it on top, so it
+        // cannot hide that key from the opcode which spends it. It still breaks the run above:
+        // padding a k-of-n is what forfeits its credit.
+        if (!IsStackNeutralNop(opcode)) {
+            last_is_key = is_key;
+            last_is_xonly = is_xonly && !inside_noop;
+        }
         last_opcode = opcode;
         last_count = count;
+        last_a_count = a_count;
         last_is_push = is_push;
     }
 
     // A script can name more signatures than the spender supplies, including in branches that
     // never run. Where the witness carries the spend it is the honest count; a P2SH spend leaves
     // its signatures in the scriptSig, which is not visible here.
+    //
+    // A taproot script-path spend trails the script with a control block and, only when one is
+    // present, an annex, but CountWitnessSignatures excludes only the true last item. A control
+    // block can fall in the 64-73 byte range at a shallow merkle depth, so when an annex pushes
+    // it off the end, it may be miscounted as a signature. That can only inflate the count this
+    // rule caps against, never shrink it, so it can only undercharge, never overcharge: a
+    // documented imprecision, not a bug.
     if (witness && !witness->stack.empty()) {
         provable = std::min(provable, CountWitnessSignatures(*witness));
     }

From 44ec48c254780b85a2ef502cb9464993740115b1 Mon Sep 17 00:00:00 2001
From: LionThunderFingers
 <42521162+LionThunderFingers@users.noreply.github.com>
Date: Sat, 10 Oct 2026 17:30:56 +0200
Subject: [PATCH 08/13] test: coverage for tapscript unproven pubkey counting

Checks the taproot leaf against the P2WSH script that says the same thing,
shape by shape, so the two are charged alike rather than only plausibly,
including at the tolerance boundary: 1-of-11 is free and 1-of-12, 1-of-13
and 5-of-16 pay the same either way.

Covers the hashlock shapes a 32 byte push must not be mistaken for a key in,
the padded and inflated runs that forfeit the credit, the OP_CHECKSIG that
opens a run crediting one of the k and not two, a k above 16 written as a
minimal push, and the key stranded on the stack that neither rule reaches.
---
 src/test/script_tests.cpp | 119 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 119 insertions(+)

diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index ab65cc4ccf06..1b62c47f0a39 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1532,6 +1532,33 @@ static CScriptWitness MultisigWitness(const int sigs, const CScript& script)
     return witness;
 }
 
+/** <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)*(n-1) <k> OP_NUMEQUAL, tapscript's k-of-n. */
+static CScript MultiAScript(const int k, const int n, const size_t key_size = 32,
+                            const opcodetype terminator = OP_NUMEQUAL)
+{
+    CScript script{CScript() << std::vector<unsigned char>(key_size, 1) << OP_CHECKSIG};
+    for (int i{1}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, static_cast<unsigned char>(i + 1)) << OP_CHECKSIGADD;
+    }
+    return script << k << terminator;
+}
+
+/** A tapscript witness offering sigs signatures, as a spend of the given k-of-n would. */
+static CScriptWitness TapscriptWitness(const int sigs, const int n, const CScript& script)
+{
+    CScriptWitness witness;
+    // A key the spend does not sign for leaves an empty stack item in place of its signature.
+    for (int i{0}; i < n - sigs; ++i) {
+        witness.stack.emplace_back();
+    }
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(64, i + 1); // a BIP340 signature, which carries no sighash byte
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    witness.stack.emplace_back(33, 0xc0); // the control block of a depth zero taproot leaf
+    return witness;
+}
+
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
 {
     using zeros = std::vector<unsigned char>;
@@ -1641,6 +1668,98 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)
                                                              << OP_2DROP << OP_2DROP << OP_DROP));
 }
 
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_tapscript_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // The same payload costs the same whichever way it is written. A 1-of-15 under P2WSH and
+    // the taproot leaf that says the same thing are charged alike, where once the leaf was free
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(1, MultisigScript(1, 15))));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(1, 15), TapscriptWitness(1, 15, MultiAScript(1, 15))));
+
+    // An x-only key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG));
+    // Ordinary tapscript multisig keeps its spare keys, exactly as OP_CHECKMULTISIG does
+    for (const auto& [k, n] : {std::pair{2, 3}, std::pair{3, 5}, std::pair{1, 2}, std::pair{1, 3},
+                               std::pair{3, 3}, std::pair{5, 5}, std::pair{11, 15}, std::pair{20, 20}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n)),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Eleven keys behind one signature are free, as under OP_CHECKMULTISIG; past the tolerance
+    // every further key is payload, however honest the spend that offers it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 11), TapscriptWitness(1, 11, MultiAScript(1, 11))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(1, 12), TapscriptWitness(1, 12, MultiAScript(1, 12))));
+    BOOST_CHECK_EQUAL("66+0", DatacarrierBytesStr(MultiAScript(1, 13), TapscriptWitness(1, 13, MultiAScript(1, 13))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(5, 16), TapscriptWitness(5, 16, MultiAScript(5, 16))));
+    for (const auto& [k, n] : {std::pair{1, 11}, std::pair{1, 12}, std::pair{1, 13}, std::pair{5, 16}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n), MultisigWitness(k, MultisigScript(k, n))),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Above 16 the key count is a minimal push rather than an OP_N, and still counts. A leaf may
+    // hold far more keys than OP_CHECKMULTISIG, so it is read up to MAX_PUBKEYS_PER_MULTI_A
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(17, 28), TapscriptWitness(17, 28, MultiAScript(17, 28))));
+    // The credit is the shape of the run, not the size of its keys: a leaf may hold either
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(3, 5, 33), TapscriptWitness(3, 5, MultiAScript(3, 5, 33))));
+    // A run closed by OP_NUMEQUALVERIFY says the same thing as one closed by OP_NUMEQUAL
+    const CScript verify{MultiAScript(3, 5, 32, OP_NUMEQUALVERIFY)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(verify, TapscriptWitness(3, 5, verify)));
+
+    // A 32 byte push is only a key where something spends it. The preimage of a hashlock and
+    // the hash it is checked against are neither of them keys, in a leaf or anywhere else
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SHA256 << zeros(32) << OP_EQUALVERIFY
+                                                           << zeros(33) << OP_CHECKSIG));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_SHA256 << zeros(32)
+                                                           << OP_EQUALVERIFY << zeros(32) << OP_CHECKSIG));
+
+    // Padding the run forfeits the credit rather than earning one, so an 11-of-15 written the
+    // long way round is charged as though it proved nothing but the key it opens on
+    CScript padded{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        padded << zeros(32) << OP_NOP << OP_CHECKSIGADD;
+    }
+    padded << 11 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(padded, TapscriptWitness(11, 15, padded)));
+    // ... while an OP_NOP does not hide the key beneath it from the opcode that spends it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_NOP << OP_CHECKSIG));
+
+    // Naming a k the run cannot satisfy forfeits the credit too
+    CScript inflated{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        inflated << zeros(32) << OP_CHECKSIGADD;
+    }
+    inflated << 20 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(inflated, TapscriptWitness(11, 15, inflated)));
+
+    // The OP_CHECKSIG a run opens on credits one of the k already, so a 1-of-n is credited once
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 3), TapscriptWitness(1, 3, MultiAScript(1, 3))));
+    // Naming more signatures than the spend offers earns nothing here as it does elsewhere
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(11, 15), TapscriptWitness(1, 15, MultiAScript(11, 15))));
+
+    // A key inside an OP_FALSE OP_IF envelope is counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(32)
+                                                            << OP_CHECKSIG << OP_ENDIF));
+    // A dropped key is already counted as dropped data; it is not charged twice, and no credit
+    // drives the count below zero
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG << zeros(33) << OP_DROP));
+    CScript over_credited{MultiAScript(3, 3)};
+    over_credited << OP_3 << OP_NUMEQUAL << OP_3 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(over_credited));
+
+    // A 32 byte push nothing spends and no drop balances is reached by neither rule. It is
+    // stranded on the stack, which leaves the leaf unspendable, so it buys nothing.
+    CScript stranded;
+    for (int i{0}; i < 15; ++i) {
+        stranded << zeros(32);
+    }
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(stranded));
+    // Balance the same pushes with drops and the run rule charges them whole
+    BOOST_CHECK_EQUAL("0+496", DatacarrierBytesStr(CScript{stranded} << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_DROP));
+}
+
 BOOST_AUTO_TEST_CASE(script_GetScriptForTransactionInput)
 {
     using zeros = std::vector<unsigned char>;

From eea24673b4d16ab305219c4cb80b13d6c8797d68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Sun, 11 Oct 2026 19:13:54 -0400
Subject: [PATCH 09/13] policy: read a tapscript k from 128 written with a zero
 high byte

---
 src/script/script.cpp     |  6 ++++--
 src/test/script_tests.cpp | 12 ++++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/script/script.cpp b/src/script/script.cpp
index 3a0f0fc92abb..057d90cc7e21 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -387,8 +387,10 @@ static int MultiACount(const opcodetype opcode, const std::vector<unsigned char>
     if (const int small{SmallIntValue(opcode)}; small > 0) return small;
     if (opcode != 1 && opcode != 2) return -1;
     if (push_data.size() != static_cast<size_t>(opcode)) return -1;
-    // A minimal push carries no redundant high byte, and the sign bit is never set here.
-    if (push_data.back() == 0 || (push_data.back() & 0x80)) return -1;
+    // The sign bit is never set here, and a zero high byte is minimal only where it keeps the
+    // byte below it from reading as the sign, as in 128 written 80 00.
+    if (push_data.back() & 0x80) return -1;
+    if (push_data.back() == 0 && (push_data.size() == 1 || !(push_data[0] & 0x80))) return -1;
     int value{push_data[0]};
     if (push_data.size() == 2) value |= int{push_data[1]} << 8;
     if (value <= 16 || value > int{MAX_PUBKEYS_PER_MULTI_A}) return -1;
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 1b62c47f0a39..ad0b80923220 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1700,6 +1700,18 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_tapscript_unproven_pubkeys)
     // Above 16 the key count is a minimal push rather than an OP_N, and still counts. A leaf may
     // hold far more keys than OP_CHECKMULTISIG, so it is read up to MAX_PUBKEYS_PER_MULTI_A
     BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(17, 28), TapscriptWitness(17, 28, MultiAScript(17, 28))));
+    // From 128 the minimal push carries a zero high byte to keep the sign clear, as in 80 00
+    for (const int k : {127, 128, 255, 256}) {
+        const CScript script{MultiAScript(k, k + 2)};
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(script, TapscriptWitness(k, k + 2, script)));
+    }
+    // ... while a zero high byte nothing needs is not minimal, and forfeits the credit
+    CScript non_minimal{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 28; ++i) {
+        non_minimal << zeros(32) << OP_CHECKSIGADD;
+    }
+    non_minimal << std::vector<unsigned char>{17, 0} << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("561+0", DatacarrierBytesStr(non_minimal, TapscriptWitness(17, 28, non_minimal)));
     // The credit is the shape of the run, not the size of its keys: a leaf may hold either
     BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(3, 5, 33), TapscriptWitness(3, 5, MultiAScript(3, 5, 33))));
     // A run closed by OP_NUMEQUALVERIFY says the same thing as one closed by OP_NUMEQUAL

From 6af1d264b184fcdeb827652d39509aef5077e241 Mon Sep 17 00:00:00 2001
From: Jason Sopko <jason@sopko.net>
Date: Sun, 27 Sep 2026 05:33:58 -0400
Subject: [PATCH 10/13] policy: Count data in a dead conditional branch

The detector counts the OP_FALSE OP_IF envelope but not its mirror, OP_1
OP_NOTIF, or any other branch constants make unreachable. 23e8f946... at
969961 carried a 37 KB JPEG XL image that way, and nothing on the fence
saw it.

Follow the script as far as constants decide it, through stack moves,
arithmetic, comparisons, no-ops and the altstack, and count every
conditional part that can never run, including the dead part of an
OP_ELSE. Anything read from the witness or a signature check is unknown
and never counted, which is how spendable scripts branch. The rule sits
behind -rejectdeadbranches, default on and reset by -corepolicy; with it
off the detector is the old one byte for byte.

Checked on Ubuntu 24.04 against 29.4.2: a gcc 13.3 -Werror build with
wallet and ZMQ has no warnings, and all 147 ctest suites and the full
functional suite pass, alone and merged with #389, #319 and #422. The
clang 18 ASan/UBSan build passes the unit suite and the policy
functional tests. A fuzz target checked that with the switch off the
result matches the original function, and that every part marked dead
leaves the interpreter's verdict unchanged when an OP_RETURN is put in
it, over 4.9 million inputs in 45 minutes. Over all 3,018,541
transactions since the fork it counts one: 23e8f946..., at 37,854 bytes.
---
 doc/release-notes-dead-branch-data.md  |  12 +
 src/init.cpp                           |   4 +
 src/policy/policy.cpp                  |   5 +-
 src/policy/policy.h                    |   2 +
 src/policy/settings.h                  |   1 +
 src/script/script.cpp                  | 407 ++++++++++++++++++++++++-
 src/script/script.h                    |   2 +-
 src/test/script_tests.cpp              |  71 ++++-
 test/functional/mempool_dead_branch.py |  99 ++++++
 test/functional/test_runner.py         |   1 +
 10 files changed, 595 insertions(+), 9 deletions(-)
 create mode 100644 doc/release-notes-dead-branch-data.md
 create mode 100755 test/functional/mempool_dead_branch.py

diff --git a/doc/release-notes-dead-branch-data.md b/doc/release-notes-dead-branch-data.md
new file mode 100644
index 000000000000..b96b71fa8138
--- /dev/null
+++ b/doc/release-notes-dead-branch-data.md
@@ -0,0 +1,12 @@
+Policy
+------
+
+- Data in a conditional part that constants make unreachable now counts as
+  data carrier bytes, so under the default settings a transaction carrying it
+  is rejected with `txn-datacarrier-nonstandard`. This already applied to the
+  `OP_FALSE OP_IF ... OP_ENDIF` inscription envelope; it now also covers
+  `OP_1 OP_NOTIF ... OP_ENDIF`, guards computed from constants, and the dead
+  part of an `OP_ELSE`. Scripts that branch on witness data or a signature
+  check, which is how spendable scripts branch, are unaffected. The new
+  `-rejectdeadbranches` option (default: 1, reset by `-corepolicy`) turns the
+  wider rule off and leaves only the envelope counted.
diff --git a/src/init.cpp b/src/init.cpp
index 1d75c41925b5..048d0cf1ec77 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -721,6 +721,7 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
     argsman.AddArg("-bytespersigopstrict", strprintf("Minimum bytes per sigop in transactions we relay and mine (default: %u)", DEFAULT_BYTES_PER_SIGOP_STRICT), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrier", strprintf("Relay and mine data carrier transactions (default: %u)", DEFAULT_ACCEPT_DATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriercost", strprintf("Treat extra data in transactions as at least N vbytes per actual byte (default: %s)", DEFAULT_WEIGHT_PER_DATA_BYTE / 4.0), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
+    argsman.AddArg("-rejectdeadbranches", strprintf("Count data in a conditional branch that a pushed constant makes unreachable as data carrier bytes; the OP_FALSE OP_IF envelope is counted either way (default: %u)", DEFAULT_REJECT_DEAD_BRANCHES), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrierfullcount", strprintf("Apply datacarriersize limit to all known datacarrier methods (default: %u)", DEFAULT_DATACARRIER_FULLCOUNT), ArgsManager::ALLOW_ANY | (DEFAULT_DATACARRIER_FULLCOUNT ? uint32_t{ArgsManager::DEBUG_ONLY} : 0), OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriersize",
                    strprintf("Maximum size of data in data carrier transactions we relay and mine, in bytes (default: %u)",
@@ -873,6 +874,7 @@ void InitParameterInteraction(ArgsManager& args)
         args.SoftSetArg("-subdustfeepenalty", "0");
         args.SoftSetArg("-datacarriercost", "0.25");
         args.SoftSetArg("-datacarrierfullcount", "0");
+        args.SoftSetArg("-rejectdeadbranches", "0");
         args.SoftSetArg("-maxtxlegacysigops", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-maxscriptsize", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-mempooltruc", "enforce");
@@ -1213,6 +1215,8 @@ bool AppInitParameterInteraction(const ArgsManager& args)
 
     g_script_size_policy_limit = args.GetIntArg("-maxscriptsize", g_script_size_policy_limit);
 
+    g_reject_dead_branches = args.GetBoolArg("-rejectdeadbranches", g_reject_dead_branches);
+
     nBytesPerSigOp = args.GetIntArg("-bytespersigop", nBytesPerSigOp);
     nBytesPerSigOpStrict = args.GetIntArg("-bytespersigopstrict", nBytesPerSigOpStrict);
 
diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index 679c0c967a1f..a41bae410b4a 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -33,6 +33,7 @@
 #include <vector>
 
 unsigned int g_script_size_policy_limit{DEFAULT_SCRIPT_SIZE_POLICY_LIMIT};
+bool g_reject_dead_branches{DEFAULT_REJECT_DEAD_BRANCHES};
 
 CAmount GetDustThreshold(const CTxOut& txout, const CFeeRate& dustRelayFeeIn)
 {
@@ -640,7 +641,7 @@ std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsV
     for (const CTxIn& txin : tx.vin) {
         const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
         auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
-        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness);
+        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, ::g_reject_dead_branches);
         ret.first += dcb.first;
         ret.second += dcb.second;
     }
@@ -664,7 +665,7 @@ int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& vi
             const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
             auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
             if (weight_per_data_byte > consensus_weight_per_byte) {
-                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness);
+                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, ::g_reject_dead_branches);
                 mod_weight += int64_t(dcb.first + dcb.second) * (weight_per_data_byte - consensus_weight_per_byte);
             }
         }
diff --git a/src/policy/policy.h b/src/policy/policy.h
index 6c52b6aebff2..e5e5be158fae 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -64,6 +64,8 @@ static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP{20};
 static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP_STRICT{20};
 /** Default for -datacarriercost (multiplied by WITNESS_SCALE_FACTOR) */
 static constexpr unsigned int DEFAULT_WEIGHT_PER_DATA_BYTE{4};
+/** Default for -rejectdeadbranches */
+static constexpr bool DEFAULT_REJECT_DEAD_BRANCHES{true};
 /** Default for -rejecttokens */
 static constexpr bool DEFAULT_REJECT_TOKENS{true};
 /** Default for -subdustfeepenalty */
diff --git a/src/policy/settings.h b/src/policy/settings.h
index 03cfc3775da1..6c60e3ecef64 100644
--- a/src/policy/settings.h
+++ b/src/policy/settings.h
@@ -10,5 +10,6 @@ extern unsigned int g_script_size_policy_limit;
 extern unsigned int nBytesPerSigOp;
 extern unsigned int nBytesPerSigOpStrict;
 extern unsigned int g_weight_per_data_byte;
+extern bool g_reject_dead_branches;
 
 #endif // BITCOIN_POLICY_SETTINGS_H
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 057d90cc7e21..40835804b584 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -306,6 +306,379 @@ bool CScript::HasValidOps() const
     return true;
 }
 
+// Static truthiness of a byte vector, matching CastToBool in the interpreter:
+// any nonzero byte is true, except a lone trailing sign bit (negative zero).
+static bool DataCarrierCastToBool(const std::vector<unsigned char>& vch)
+{
+    for (size_t i = 0; i < vch.size(); ++i) {
+        if (vch[i] != 0) {
+            if (i == vch.size() - 1 && vch[i] == 0x80) return false;
+            return true;
+        }
+    }
+    return false;
+}
+
+namespace {
+/** A value on the stack that follows from constants alone, as an index into KnownValues; 0 if it depends on the witness or a signature */
+using KnownValue = size_t;
+constexpr KnownValue UNKNOWN{0};
+
+/** The values FindDeadParts has seen; the stacks hold indexes, so copying a value costs nothing */
+class KnownValues
+{
+    std::vector<std::vector<unsigned char>> m_values{{}};
+
+public:
+    KnownValue Add(std::vector<unsigned char> v)
+    {
+        m_values.push_back(std::move(v));
+        return m_values.size() - 1;
+    }
+    KnownValue AddNum(int64_t n) { return Add(CScriptNum{n}.getvch()); }
+    const std::vector<unsigned char>& Get(KnownValue v) const { return m_values[v]; }
+    /** The value as a script number, if it is known and a valid one */
+    bool Num(KnownValue v, int64_t& out) const
+    {
+        if (v == UNKNOWN) return false;
+        try {
+            out = CScriptNum{m_values[v], /*fRequireMinimal=*/true}.GetInt64();
+            return true;
+        } catch (const scriptnum_error&) {
+            return false;
+        }
+    }
+};
+
+/** Byte offsets of the OP_IF/OP_NOTIF whose first part, and the OP_ELSE whose part, a constant guard makes unreachable */
+struct DeadParts {
+    std::vector<bool> at_if, at_else;
+};
+
+/** The top of the stack as far as constants determine it; below it nothing is known */
+class KnownStack
+{
+    std::vector<KnownValue> m_items;
+
+public:
+    size_t size() const { return m_items.size(); }
+    void Push(KnownValue v)
+    {
+        m_items.push_back(std::move(v));
+        if (m_items.size() > MAX_STACK_SIZE) Forget(); // the script fails here anyway
+    }
+    KnownValue Pop()
+    {
+        if (m_items.empty()) return UNKNOWN;
+        KnownValue v{std::move(m_items.back())};
+        m_items.pop_back();
+        return v;
+    }
+    KnownValue Peek(size_t depth) const { return depth < m_items.size() ? m_items[m_items.size() - 1 - depth] : UNKNOWN; }
+    KnownValue& At(size_t depth) { return m_items[m_items.size() - 1 - depth]; }
+    void Forget() { m_items.clear(); }
+};
+
+/**
+ * Follow the script as far as constants determine it and mark the conditional
+ * parts that can never run. Anything read from the witness, a signature check,
+ * a hash or an opcode not modeled here is unknown, and an unknown condition
+ * marks nothing, so a spendable script is never read as dead.
+ */
+DeadParts FindDeadParts(const CScript& script)
+{
+    DeadParts dead{std::vector<bool>(script.size()), std::vector<bool>(script.size())};
+    // Per open conditional: whether constants decide it, and whether its current part runs
+    struct Frame { bool known; bool running; };
+    std::vector<Frame> frames;
+    size_t not_running{0}; // open frames whose current part does not run
+    KnownValues values;
+    KnownStack stack, alt;
+    opcodetype opcode;
+    std::vector<unsigned char> push;
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        const size_t offset{size_t(it - script.begin())};
+        if (!script.GetOp(it, opcode, push)) break;
+
+        if (opcode == OP_IF || opcode == OP_NOTIF) {
+            if (not_running) {
+                frames.push_back({true, false});
+                ++not_running;
+                continue;
+            }
+            const KnownValue cond{stack.Pop()};
+            if (cond != UNKNOWN) {
+                const bool runs{DataCarrierCastToBool(values.Get(cond)) == (opcode == OP_IF)};
+                if (!runs) {
+                    dead.at_if[offset] = true;
+                    ++not_running;
+                }
+                frames.push_back({true, runs});
+            } else {
+                frames.push_back({false, true});
+            }
+            continue;
+        }
+        if (opcode == OP_ELSE || opcode == OP_ENDIF) {
+            if (frames.empty()) break; // unbalanced: the script cannot run
+            Frame& frame{frames.back()};
+            const bool outer_running{not_running == (frame.running ? 0 : 1)};
+            if (opcode == OP_ELSE) {
+                if (frame.known && outer_running) {
+                    frame.running = !frame.running;
+                    if (frame.running) {
+                        --not_running;
+                    } else {
+                        ++not_running;
+                        dead.at_else[offset] = true;
+                    }
+                } else if (!frame.known) {
+                    // The else part starts from the state before the OP_IF, which is not kept
+                    stack.Forget();
+                    alt.Forget();
+                }
+            } else {
+                if (!frame.running) --not_running;
+                if (!frame.known && not_running == 0) {
+                    stack.Forget();
+                    alt.Forget();
+                }
+                frames.pop_back();
+            }
+            continue;
+        }
+        if (not_running) continue;
+
+        if (opcode <= OP_PUSHDATA4) {
+            stack.Push(values.Add(push));
+            continue;
+        }
+        if (opcode == OP_1NEGATE || (opcode >= OP_1 && opcode <= OP_16)) {
+            stack.Push(values.AddNum(opcode == OP_1NEGATE ? -1 : CScript::DecodeOP_N(opcode)));
+            continue;
+        }
+        switch (opcode) {
+        case OP_NOP: case OP_NOP1: case OP_CHECKLOCKTIMEVERIFY: case OP_CHECKSEQUENCEVERIFY:
+        case OP_NOP4: case OP_NOP5: case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
+        case OP_CODESEPARATOR:
+            break;
+        case OP_VERIFY: case OP_DROP:
+            stack.Pop();
+            break;
+        case OP_2DROP:
+            stack.Pop();
+            stack.Pop();
+            break;
+        case OP_TOALTSTACK:
+            alt.Push(stack.Pop());
+            break;
+        case OP_FROMALTSTACK:
+            stack.Push(alt.Pop());
+            break;
+        case OP_DUP:
+            stack.Push(stack.Peek(0));
+            break;
+        case OP_OVER:
+            stack.Push(stack.Peek(1));
+            break;
+        case OP_2DUP: {
+            const KnownValue a{stack.Peek(1)}, b{stack.Peek(0)};
+            stack.Push(a);
+            stack.Push(b);
+            break;
+        }
+        case OP_3DUP: {
+            const KnownValue a{stack.Peek(2)}, b{stack.Peek(1)}, c{stack.Peek(0)};
+            stack.Push(a);
+            stack.Push(b);
+            stack.Push(c);
+            break;
+        }
+        case OP_2OVER: {
+            const KnownValue a{stack.Peek(3)}, b{stack.Peek(2)};
+            stack.Push(a);
+            stack.Push(b);
+            break;
+        }
+        case OP_IFDUP: {
+            const KnownValue top{stack.Peek(0)};
+            if (top == UNKNOWN) {
+                stack.Forget(); // whether it duplicates is not known, so neither is the depth
+            } else if (DataCarrierCastToBool(values.Get(top))) {
+                stack.Push(top);
+            }
+            break;
+        }
+        case OP_SIZE: {
+            const KnownValue top{stack.Peek(0)};
+            stack.Push(top == UNKNOWN ? UNKNOWN : values.AddNum(values.Get(top).size()));
+            break;
+        }
+        case OP_DEPTH:
+            stack.Push(UNKNOWN);
+            break;
+        case OP_NIP: case OP_SWAP: case OP_TUCK: case OP_ROT: case OP_2SWAP: case OP_2ROT: {
+            const size_t need{opcode == OP_2ROT ? 6u : opcode == OP_2SWAP ? 4u : opcode == OP_ROT ? 3u : 2u};
+            if (stack.size() < need) {
+                stack.Forget();
+                break;
+            }
+            if (opcode == OP_NIP) {
+                const KnownValue top{stack.Pop()};
+                stack.Pop();
+                stack.Push(top);
+            } else if (opcode == OP_SWAP) {
+                std::swap(stack.At(0), stack.At(1));
+            } else if (opcode == OP_TUCK) {
+                const KnownValue top{stack.Pop()}, second{stack.Pop()};
+                stack.Push(top);
+                stack.Push(second);
+                stack.Push(top);
+            } else if (opcode == OP_ROT) {
+                std::swap(stack.At(2), stack.At(1));
+                std::swap(stack.At(1), stack.At(0));
+            } else if (opcode == OP_2SWAP) {
+                std::swap(stack.At(3), stack.At(1));
+                std::swap(stack.At(2), stack.At(0));
+            } else {
+                std::vector<KnownValue> six;
+                for (int i{0}; i < 6; ++i) six.push_back(stack.Pop());
+                // six[5] and six[4] were deepest; they move to the top
+                for (int i{3}; i >= 0; --i) stack.Push(six[i]);
+                stack.Push(six[5]);
+                stack.Push(six[4]);
+            }
+            break;
+        }
+        case OP_PICK: case OP_ROLL: {
+            int64_t n;
+            const bool known{values.Num(stack.Pop(), n)};
+            if (!known || n < 0 || size_t(n) >= stack.size()) {
+                // Reaches below what is known, or the depth itself is unknown
+                if (opcode == OP_ROLL || !known) stack.Forget();
+                stack.Push(UNKNOWN);
+                break;
+            }
+            const KnownValue v{stack.At(n)};
+            if (opcode == OP_ROLL) {
+                std::vector<KnownValue> above;
+                for (int64_t i{0}; i < n; ++i) above.push_back(stack.Pop());
+                stack.Pop();
+                for (auto i{above.rbegin()}; i != above.rend(); ++i) stack.Push(*i);
+            }
+            stack.Push(v);
+            break;
+        }
+        case OP_EQUAL: case OP_EQUALVERIFY: {
+            const KnownValue b{stack.Pop()}, a{stack.Pop()};
+            if (opcode == OP_EQUAL) {
+                stack.Push(a == UNKNOWN || b == UNKNOWN ? UNKNOWN : values.Add(values.Get(a) == values.Get(b) ? std::vector<unsigned char>{1} : std::vector<unsigned char>{}));
+            }
+            break;
+        }
+        case OP_1ADD: case OP_1SUB: case OP_NEGATE: case OP_ABS: case OP_NOT: case OP_0NOTEQUAL: {
+            int64_t a;
+            if (!values.Num(stack.Pop(), a)) {
+                stack.Push(UNKNOWN);
+                break;
+            }
+            int64_t r{};
+            switch (opcode) {
+            case OP_1ADD: r = a + 1; break;
+            case OP_1SUB: r = a - 1; break;
+            case OP_NEGATE: r = -a; break;
+            case OP_ABS: r = a < 0 ? -a : a; break;
+            case OP_NOT: r = a == 0; break;
+            default: r = a != 0; break;
+            }
+            stack.Push(values.AddNum(r));
+            break;
+        }
+        case OP_ADD: case OP_SUB: case OP_BOOLAND: case OP_BOOLOR: case OP_NUMEQUAL: case OP_NUMEQUALVERIFY:
+        case OP_NUMNOTEQUAL: case OP_LESSTHAN: case OP_GREATERTHAN: case OP_LESSTHANOREQUAL:
+        case OP_GREATERTHANOREQUAL: case OP_MIN: case OP_MAX: {
+            int64_t a, b;
+            const bool known_b{values.Num(stack.Pop(), b)};
+            const bool known_a{values.Num(stack.Pop(), a)};
+            if (opcode == OP_NUMEQUALVERIFY) break;
+            if (!known_a || !known_b) {
+                stack.Push(UNKNOWN);
+                break;
+            }
+            int64_t r{};
+            switch (opcode) {
+            case OP_ADD: r = a + b; break;
+            case OP_SUB: r = a - b; break;
+            case OP_BOOLAND: r = a != 0 && b != 0; break;
+            case OP_BOOLOR: r = a != 0 || b != 0; break;
+            case OP_NUMEQUAL: r = a == b; break;
+            case OP_NUMNOTEQUAL: r = a != b; break;
+            case OP_LESSTHAN: r = a < b; break;
+            case OP_GREATERTHAN: r = a > b; break;
+            case OP_LESSTHANOREQUAL: r = a <= b; break;
+            case OP_GREATERTHANOREQUAL: r = a >= b; break;
+            case OP_MIN: r = a < b ? a : b; break;
+            default: r = a > b ? a : b; break;
+            }
+            stack.Push(values.AddNum(r));
+            break;
+        }
+        case OP_WITHIN: {
+            int64_t hi, lo, x;
+            const bool known_hi{values.Num(stack.Pop(), hi)};
+            const bool known_lo{values.Num(stack.Pop(), lo)};
+            const bool known_x{values.Num(stack.Pop(), x)};
+            stack.Push(known_hi && known_lo && known_x ? values.AddNum(lo <= x && x < hi) : UNKNOWN);
+            break;
+        }
+        case OP_RIPEMD160: case OP_SHA1: case OP_SHA256: case OP_HASH160: case OP_HASH256:
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKSIG:
+            stack.Pop();
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKSIGVERIFY:
+            stack.Pop();
+            stack.Pop();
+            break;
+        case OP_CHECKSIGADD:
+            stack.Pop();
+            stack.Pop();
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKMULTISIG: case OP_CHECKMULTISIGVERIFY: {
+            int64_t keys, sigs;
+            if (!values.Num(stack.Pop(), keys) || keys < 0 || keys > MAX_PUBKEYS_PER_MULTISIG) {
+                stack.Forget();
+            } else {
+                for (int64_t i{0}; i < keys; ++i) stack.Pop();
+                if (!values.Num(stack.Pop(), sigs) || sigs < 0 || sigs > keys) {
+                    stack.Forget();
+                } else {
+                    for (int64_t i{0}; i < sigs + 1; ++i) stack.Pop(); // the signatures and the dummy
+                }
+            }
+            if (opcode == OP_CHECKMULTISIG) stack.Push(UNKNOWN);
+            break;
+        }
+        case OP_RETURN:
+            return dead; // the script fails here
+        default:
+            // Not modeled: forget what is known rather than guess
+            stack.Forget();
+            alt.Forget();
+            break;
+        }
+    }
+    return dead;
+}
+} // namespace
+
 size_t CScript::IsOLGA(const size_t remaining_outputs) const
 {
     if (!IsPayToWitnessScriptHash()) {
@@ -572,7 +945,7 @@ static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* w
     return (pubkeys - provable - MAX_UNPROVEN_PUBKEYS) * CPubKey::COMPRESSED_SIZE;
 }
 
-std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness) const
+std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness, const bool dead_branches) const
 {
     if (size_t olga_bytes = IsOLGA(remaining_outputs); olga_bytes) {
         return {0, olga_bytes};
@@ -584,6 +957,10 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
         }
     }
 
+    // Where a constant guard makes part of a conditional unreachable
+    const DeadParts dead{dead_branches ? FindDeadParts(*this) : DeadParts{}};
+    // A span that began at a conditional counts its guard push too; one that began at OP_ELSE does not
+    size_t span_guard{1};
     size_t counted{0};
     opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
     std::vector<unsigned char> push_data;
@@ -607,20 +984,42 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
             return {size(), 0};
         }
 
-        // Match OP_FALSE OP_IF
+        // Count a conditional part that constants make unreachable: the
+        // OP_FALSE OP_IF inscription envelope, and with dead_branches any part
+        // FindDeadParts marks, including an OP_ELSE part. Pushes there cannot
+        // affect the spend, so they are data. With dead_branches an OP_ELSE
+        // switches between the counted and the live part; without it only the
+        // envelope counts, through its OP_ENDIF.
+        const size_t offset{size_t(opcode_it - begin())};
+        const bool dead_guard{(opcode == OP_IF && last_opcode == OP_FALSE) ||
+                              (dead_branches && (opcode == OP_IF || opcode == OP_NOTIF) && dead.at_if[offset])};
+        if (dead_branches && !inside_noop && opcode == OP_ELSE && dead.at_else[offset]) {
+            inside_noop = 1;
+            data_began = opcode_it;
+            span_guard = 0;
+            continue;
+        }
+        if (dead_guard && !inside_noop) span_guard = 1;
+
         if (inside_noop) {
             switch (opcode) {
             case OP_IF: case OP_NOTIF:
                 ++inside_noop;
                 break;
+            case OP_ELSE:
+                if (dead_branches && inside_noop == 1) {
+                    counted += opcode_it - data_began + span_guard;
+                    inside_noop = 0;
+                }
+                break;
             case OP_ENDIF:
                 if (0 == --inside_noop) {
-                    counted += it - data_began + 1;
+                    counted += it - data_began + span_guard;
                 }
                 break;
             default: /* do nothing */;
             }
-        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+        } else if (dead_guard) {
             inside_noop = 1;
             data_began = opcode_it;
         // Match <data> OP_DROP, or a run of <data>/pushnums ... OP_DROP/OP_2DROP (bare/BIP-110 envelope)
diff --git a/src/script/script.h b/src/script/script.h
index cb2d1ece774b..8d507f61db60 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -578,7 +578,7 @@ class CScript : public CScriptBase
 
     size_t OPNetWitnessSize(const CScriptWitness& witness) const;
     size_t IsOLGA(size_t remaining_outputs) const;
-    std::pair<size_t, size_t> DatacarrierBytes(size_t remaining_outputs, const CScriptWitness* witness = nullptr) const;
+    std::pair<size_t, size_t> DatacarrierBytes(size_t remaining_outputs, const CScriptWitness* witness = nullptr, bool dead_branches = false) const;
 
     void clear()
     {
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index e3108470d399..b8a5f09c952d 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1623,8 +1623,8 @@ BOOST_AUTO_TEST_CASE(script_HasValidOps)
     BOOST_CHECK(!script.HasValidOps());
 }
 
-static std::string DatacarrierBytesStr(const CScript &script, const size_t remaining_outputs = 0) {
-    auto dcb = script.DatacarrierBytes(remaining_outputs);
+static std::string DatacarrierBytesStr(const CScript &script, const size_t remaining_outputs = 0, const bool dead_branches = true) {
+    auto dcb = script.DatacarrierBytes(remaining_outputs, nullptr, dead_branches);
     return strprintf("%s+%s", dcb.first, dcb.second);
 }
 
@@ -1717,6 +1717,73 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(olga_header, 1));
     // OGLA with extra outputs still is OLGA
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 3));
+
+    // A dead branch guarded by a true constant before OP_NOTIF is data, the
+    // mirror of the OP_FALSE OP_IF envelope above (JXL-n-hide witness shape).
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_16 << OP_NOTIF << OP_7 << OP_ENDIF));
+    // Empty dead branch counts its span, same as OP_FALSE OP_IF OP_ENDIF.
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_TRUE << OP_NOTIF << OP_ENDIF));
+    // A live branch is not data: false before OP_NOTIF, or true before OP_IF.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_0 << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_7 << OP_ENDIF));
+    // A guard that depends on the witness or a signature is not counted: this
+    // is how spendable scripts branch (Lightning, miniscript)
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SIZE << 32 << OP_EQUAL << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_CHECKSIG << OP_NOTIF << OP_7 << OP_ENDIF));
+    // A guard that constants decide is counted however it is computed
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_NOP << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_DUP << OP_DROP << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_TOALTSTACK << OP_FROMALTSTACK << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_2 << OP_EQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_1 << OP_EQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_2 << OP_3 << OP_ADD << OP_5 << OP_NUMNOTEQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_16 << OP_CHECKSEQUENCEVERIFY << OP_DROP << OP_NOTIF << OP_7 << OP_ENDIF));
+    // A constant pushed before a witness-dependent conditional is still known inside it
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF << OP_ENDIF));
+    // Lightning scripts (BOLT 3) count nothing
+    const std::vector<unsigned char> key(33, 0x02), hash(20, 0x11);
+    const CScript to_local{CScript() << OP_IF << key << OP_ELSE << 144 << OP_CHECKSEQUENCEVERIFY << OP_DROP << key << OP_ENDIF << OP_CHECKSIG};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(to_local));
+    const CScript offered_htlc{CScript() << OP_DUP << OP_HASH160 << hash << OP_EQUAL << OP_IF << OP_CHECKSIG << OP_ELSE << key << OP_SWAP
+        << OP_SIZE << 32 << OP_EQUAL << OP_NOTIF << OP_DROP << 2 << OP_SWAP << key << 2 << OP_CHECKMULTISIG << OP_ELSE << OP_HASH160
+        << hash << OP_EQUALVERIFY << OP_CHECKSIG << OP_ENDIF << OP_ENDIF};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(offered_htlc));
+    const CScript anchor{CScript() << key << OP_CHECKSIG << OP_IFDUP << OP_NOTIF << OP_16 << OP_CHECKSEQUENCEVERIFY << OP_ENDIF};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(anchor));
+    // The guard can be a data push, judged by its value: a zero push is false
+    // (dead OP_IF), a one push is true (dead OP_NOTIF); the reverse is live.
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << "00"_hex << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << "01"_hex << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << "01"_hex << OP_IF << OP_7 << OP_ENDIF));
+    // The witness script shape from JXL-n-hide tx 23e8f946...: OP_1 OP_NOTIF,
+    // six 255-byte pushes, OP_ENDIF OP_1. The whole dead branch is counted.
+    CScript jxl_witness = CScript() << OP_1 << OP_NOTIF;
+    for (int i = 0; i < 6; ++i) jxl_witness << std::vector<unsigned char>(255, 0xab);
+    jxl_witness << OP_ENDIF << OP_1;
+    BOOST_CHECK_EQUAL("0+1545", DatacarrierBytesStr(jxl_witness));
+
+    // OP_ELSE switches between the counted and the live part: the live else of
+    // a dead branch is not data, and the dead else of a live one is
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << OP_0 << OP_NOTIF << OP_ELSE << zeros(10) << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    // Repeated OP_ELSE keeps toggling, as the interpreter does
+    BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ELSE << OP_9 << OP_ENDIF));
+    // A dead branch nested in a live else is found
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_ELSE << OP_0 << OP_IF << OP_7 << OP_ENDIF << OP_ENDIF));
+
+    // With -rejectdeadbranches=0 only the OP_FALSE OP_IF envelope counts, as before, through its OP_ENDIF
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(jxl_witness, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << "00"_hex << OP_IF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP, 0, false));
+    BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF, 0, false));
 }
 
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)
diff --git a/test/functional/mempool_dead_branch.py b/test/functional/mempool_dead_branch.py
new file mode 100755
index 000000000000..93cffa9196ed
--- /dev/null
+++ b/test/functional/mempool_dead_branch.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Knots developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test data in a dead conditional branch and -rejectdeadbranches"""
+from test_framework.messages import (
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+)
+from test_framework.script import (
+    CScript,
+    OP_0,
+    OP_1,
+    OP_ELSE,
+    OP_ENDIF,
+    OP_IF,
+    OP_NOP,
+    OP_NOTIF,
+)
+from test_framework.script_util import script_to_p2wsh_script
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal, assert_greater_than
+from test_framework.wallet import MiniWallet
+
+
+class DeadBranchTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 5
+        self.extra_args = [
+            [],  # the framework passes -corepolicy, which accepts non-standard carriers
+            ["-corepolicy=0"],  # the Knots default
+            ["-corepolicy=0", "-rejectdeadbranches=0"],
+            ["-corepolicy=0", "-acceptnonstddatacarrier=1"],
+            ["-corepolicy=0", "-acceptnonstddatacarrier=1", "-rejectdeadbranches=0"],
+        ]
+
+    def spend(self, witness_script):
+        """Fund a P2WSH output to witness_script and return its spend, which needs no signature"""
+        funding = self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_to_p2wsh_script(witness_script), amount=100000)
+        self.generate(self.nodes[0], 1)
+        tx = CTransaction()
+        tx.version = 2
+        tx.vin = [CTxIn(COutPoint(int(funding["txid"], 16), funding["sent_vout"]))]
+        tx.vout = [CTxOut(99000, self.wallet.get_output_script())]
+        tx.wit.vtxinwit = [CTxInWitness()]
+        tx.wit.vtxinwit[0].scriptWitness.stack = [bytes(witness_script)]
+        return tx.serialize().hex()
+
+    def check(self, node, tx_hex, allowed, reason=None):
+        result = node.testmempoolaccept([tx_hex])[0]
+        assert_equal(result["allowed"], allowed)
+        if reason:
+            assert_equal(result["reject-reason"], reason)
+        return result
+
+    def run_test(self):
+        self.wallet = MiniWallet(self.nodes[0])
+        corepolicy, default, disabled, costed, costed_disabled = self.nodes
+
+        # OP_1 makes OP_NOTIF skip its branch, so the push cannot affect the
+        # spend. This is the JXL-n-hide witness shape; the OP_FALSE OP_IF
+        # inscription envelope is the same idea with the constant reversed.
+        self.log.info("Data in an OP_1 OP_NOTIF branch is rejected by default")
+        dead_notif = self.spend(CScript([OP_1, OP_NOTIF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, dead_notif, False, "txn-datacarrier-nonstandard")
+
+        self.log.info("-rejectdeadbranches=0 and -corepolicy accept it")
+        self.check(disabled, dead_notif, True)
+        self.check(corepolicy, dead_notif, True)
+
+        self.log.info("Data in the else of a branch a constant always takes is rejected too")
+        dead_else = self.spend(CScript([OP_1, OP_IF, OP_1, OP_ELSE, b'\xab' * 10, OP_ENDIF]))
+        self.check(default, dead_else, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, dead_else, True)
+
+        self.log.info("A guard that constants decide is counted however it is computed")
+        nop_guard = self.spend(CScript([OP_1, OP_NOP, OP_NOTIF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, nop_guard, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, nop_guard, True)
+
+        self.log.info("-rejectdeadbranches=0 still counts the OP_FALSE OP_IF envelope")
+        envelope = self.spend(CScript([OP_0, OP_IF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, envelope, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, envelope, False, "txn-datacarrier-nonstandard")
+
+        self.log.info("A branch the guard takes is not counted: its push is the spend's result")
+        self.check(default, self.spend(CScript([OP_0, OP_NOTIF, b'\xab' * 10, OP_ENDIF])), True)
+
+        self.log.info("The switch reaches -datacarriercost too")
+        counted = self.check(costed, dead_notif, True)
+        uncounted = self.check(costed_disabled, dead_notif, True)
+        assert_greater_than(counted["vsize"], uncounted["vsize"])
+
+
+if __name__ == '__main__':
+    DeadBranchTest(__file__).main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 45a49f73a0ed..0acaa20ff8f6 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -296,6 +296,7 @@
     'feature_utxo_set_hash.py',
     'feature_rbf.py',
     'mempool_packages.py',
+    'mempool_dead_branch.py',
     'mempool_package_onemore.py',
     'mempool_package_limits.py',
     'mempool_package_rbf.py',

From 9c81d406959d183845f27835dd2c6cd31372a236 Mon Sep 17 00:00:00 2001
From: Jason Sopko <jason@sopko.net>
Date: Thu, 1 Oct 2026 23:41:23 -0400
Subject: [PATCH 11/13] policy: Bound the dead-branch analysis to the script
 size

FindDeadParts ran on every input before IsWitnessStandard checks the
witness size, and OP_ROLL with a known depth moved up to 1,000 stack
entries. A 390 KB script repeating <998> OP_ROLL took 506 ms to analyze
against 1.7 ms for the plain scan, on a transaction the node then
rejects at no cost to the sender. AuthintegX raised it in the Knots
Discord.

Skip inputs whose witness is over -maxscriptsize, which fail
IsWitnessStandard right after, and charge each opcode one step and each
OP_ROLL its depth, stopping at four steps per byte. Stopping marks
nothing more, so it can only undercount, the same as a condition read
from the witness.

The roll case drops to 92 us at 1,650 bytes (was 882) and 9.7 ms at
390 KB. The worst left is an arithmetic chain at about 85 ns per byte,
the same order as the interpreter on that script. Counts over all
3,103,397 transactions from 961640 to 974573 are unchanged.
---
 src/policy/policy.cpp     | 14 ++++++++++++--
 src/script/script.cpp     |  9 +++++++++
 src/test/script_tests.cpp | 13 +++++++++++++
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index a41bae410b4a..8efcde9bf4ef 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -634,6 +634,16 @@ std::pair<CScript, unsigned int> GetScriptForTransactionInput(CScript prevScript
     return std::make_pair(CScript(), 0);
 }
 
+/**
+ * Whether to look for dead branches in this input. A witness over the script size
+ * limit fails IsWitnessStandard right after, so following its constants would be
+ * work spent on a transaction that is rejected anyway.
+ */
+static bool FollowDeadBranches(const CTxIn& txin)
+{
+    return ::g_reject_dead_branches && GetSerializeSize(txin.scriptWitness.stack) <= g_script_size_policy_limit;
+}
+
 std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view)
 {
     std::pair<size_t, size_t> ret{0, 0};
@@ -641,7 +651,7 @@ std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsV
     for (const CTxIn& txin : tx.vin) {
         const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
         auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
-        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, ::g_reject_dead_branches);
+        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, FollowDeadBranches(txin));
         ret.first += dcb.first;
         ret.second += dcb.second;
     }
@@ -665,7 +675,7 @@ int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& vi
             const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
             auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
             if (weight_per_data_byte > consensus_weight_per_byte) {
-                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, ::g_reject_dead_branches);
+                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, FollowDeadBranches(txin));
                 mod_weight += int64_t(dcb.first + dcb.second) * (weight_per_data_byte - consensus_weight_per_byte);
             }
         }
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 40835804b584..807283e8251d 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -396,10 +396,17 @@ DeadParts FindDeadParts(const CScript& script)
     KnownStack stack, alt;
     opcodetype opcode;
     std::vector<unsigned char> push;
+    // Each opcode costs one step, and OP_ROLL also costs its depth, the one move
+    // that is not constant time. Stop, marking nothing more, after a few steps per
+    // byte: no spendable script rolls deep over and over, and one built to do so
+    // gets the plain scan instead of costing the node more than its size.
+    size_t steps_left{4 * size_t{script.size()}};
 
     for (CScript::const_iterator it{script.begin()}; it < script.end();) {
         const size_t offset{size_t(it - script.begin())};
         if (!script.GetOp(it, opcode, push)) break;
+        if (steps_left == 0) break;
+        --steps_left;
 
         if (opcode == OP_IF || opcode == OP_NOTIF) {
             if (not_running) {
@@ -562,6 +569,8 @@ DeadParts FindDeadParts(const CScript& script)
             }
             const KnownValue v{stack.At(n)};
             if (opcode == OP_ROLL) {
+                if (size_t(n) > steps_left) return dead;
+                steps_left -= n;
                 std::vector<KnownValue> above;
                 for (int64_t i{0}; i < n; ++i) above.push_back(stack.Pop());
                 stack.Pop();
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index b8a5f09c952d..f18dca4ea4aa 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1784,6 +1784,19 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP, 0, false));
     BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF, 0, false));
     BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF, 0, false));
+
+    // Following constants costs one step per opcode plus each OP_ROLL's depth, at most
+    // four per byte: one deep roll before the guard is followed, a string of them is not
+    const CScript dead_tail = CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF;
+    const auto deep_rolls = [&](int rolls) {
+        CScript s;
+        for (int i{0}; i < 999; ++i) s << OP_1;
+        for (int i{0}; i < rolls; ++i) s << CScriptNum{998} << OP_ROLL;
+        s.insert(s.end(), dead_tail.begin(), dead_tail.end());
+        return s;
+    };
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(deep_rolls(1)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(deep_rolls(10)));
 }
 
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)

From 847d6a232f9e3f29ba3f24f37214232498e520b7 Mon Sep 17 00:00:00 2001
From: Jason Sopko <jason@sopko.net>
Date: Wed, 14 Oct 2026 21:44:55 -0400
Subject: [PATCH 12/13] policy: Zero the number locals in the dead-branch walk

gcc 11 at -O2 cannot see that OP_WITHIN reads lo only after Num() has
set it, and the previous-releases CI job (DEBUG, -Werror) fails with
"'lo' may be used uninitialized". Start every int64_t the walk fills
through Num() at zero so no compiler has to prove it. No behavior
change: each one is still read only where Num() returned true.
---
 src/script/script.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/script/script.cpp b/src/script/script.cpp
index 807283e8251d..caba9af5b8c1 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -559,7 +559,7 @@ DeadParts FindDeadParts(const CScript& script)
             break;
         }
         case OP_PICK: case OP_ROLL: {
-            int64_t n;
+            int64_t n{0};
             const bool known{values.Num(stack.Pop(), n)};
             if (!known || n < 0 || size_t(n) >= stack.size()) {
                 // Reaches below what is known, or the depth itself is unknown
@@ -587,7 +587,7 @@ DeadParts FindDeadParts(const CScript& script)
             break;
         }
         case OP_1ADD: case OP_1SUB: case OP_NEGATE: case OP_ABS: case OP_NOT: case OP_0NOTEQUAL: {
-            int64_t a;
+            int64_t a{0};
             if (!values.Num(stack.Pop(), a)) {
                 stack.Push(UNKNOWN);
                 break;
@@ -607,7 +607,7 @@ DeadParts FindDeadParts(const CScript& script)
         case OP_ADD: case OP_SUB: case OP_BOOLAND: case OP_BOOLOR: case OP_NUMEQUAL: case OP_NUMEQUALVERIFY:
         case OP_NUMNOTEQUAL: case OP_LESSTHAN: case OP_GREATERTHAN: case OP_LESSTHANOREQUAL:
         case OP_GREATERTHANOREQUAL: case OP_MIN: case OP_MAX: {
-            int64_t a, b;
+            int64_t a{0}, b{0};
             const bool known_b{values.Num(stack.Pop(), b)};
             const bool known_a{values.Num(stack.Pop(), a)};
             if (opcode == OP_NUMEQUALVERIFY) break;
@@ -634,7 +634,7 @@ DeadParts FindDeadParts(const CScript& script)
             break;
         }
         case OP_WITHIN: {
-            int64_t hi, lo, x;
+            int64_t hi{0}, lo{0}, x{0};
             const bool known_hi{values.Num(stack.Pop(), hi)};
             const bool known_lo{values.Num(stack.Pop(), lo)};
             const bool known_x{values.Num(stack.Pop(), x)};
@@ -661,7 +661,7 @@ DeadParts FindDeadParts(const CScript& script)
             stack.Push(UNKNOWN);
             break;
         case OP_CHECKMULTISIG: case OP_CHECKMULTISIGVERIFY: {
-            int64_t keys, sigs;
+            int64_t keys{0}, sigs{0};
             if (!values.Num(stack.Pop(), keys) || keys < 0 || keys > MAX_PUBKEYS_PER_MULTISIG) {
                 stack.Forget();
             } else {

From df767118a99069be8e84137d5511007c8ab53725 Mon Sep 17 00:00:00 2001
From: Jason Sopko <jason@sopko.net>
Date: Fri, 16 Oct 2026 22:04:24 -0400
Subject: [PATCH 13/13] fuzz: Add the dead-branch datacarrier target

Chris asked on #400 for the fuzz target the description mentions, so the
property that -rejectdeadbranches=0 is the old count survives the next
rebase. datacarrier_dead_branch checks four things on a fuzzed script and
witness: with the rule off the non-standard count equals the pre-rule
function, kept here as a reference copy, and the unproven pubkey count is
the same with the rule on or off; with the rule on the count never exceeds
the script size or the old count, whichever is larger; every part
FindDeadParts marks dead leaves the interpreter's verdict unchanged when an
OP_RETURN is put at its start, against an OP_NOP there as the control; and
a balanced script without OP_ELSE that the envelope rule counted is still
counted.

FindDeadParts and DeadParts move out of the anonymous namespace into
script.h so the target can call them. No behavior change.

Ran the target for 10 minutes under libFuzzer (3,436,239 runs,
no findings).
---
 src/script/script.cpp                     |  14 +--
 src/script/script.h                       |  13 ++
 src/test/fuzz/CMakeLists.txt              |   1 +
 src/test/fuzz/datacarrier_dead_branch.cpp | 144 ++++++++++++++++++++++
 4 files changed, 160 insertions(+), 12 deletions(-)
 create mode 100644 src/test/fuzz/datacarrier_dead_branch.cpp

diff --git a/src/script/script.cpp b/src/script/script.cpp
index caba9af5b8c1..0fbb8f4ea7a0 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -350,11 +350,6 @@ class KnownValues
     }
 };
 
-/** Byte offsets of the OP_IF/OP_NOTIF whose first part, and the OP_ELSE whose part, a constant guard makes unreachable */
-struct DeadParts {
-    std::vector<bool> at_if, at_else;
-};
-
 /** The top of the stack as far as constants determine it; below it nothing is known */
 class KnownStack
 {
@@ -379,12 +374,8 @@ class KnownStack
     void Forget() { m_items.clear(); }
 };
 
-/**
- * Follow the script as far as constants determine it and mark the conditional
- * parts that can never run. Anything read from the witness, a signature check,
- * a hash or an opcode not modeled here is unknown, and an unknown condition
- * marks nothing, so a spendable script is never read as dead.
- */
+} // namespace
+
 DeadParts FindDeadParts(const CScript& script)
 {
     DeadParts dead{std::vector<bool>(script.size()), std::vector<bool>(script.size())};
@@ -686,7 +677,6 @@ DeadParts FindDeadParts(const CScript& script)
     }
     return dead;
 }
-} // namespace
 
 size_t CScript::IsOLGA(const size_t remaining_outputs) const
 {
diff --git a/src/script/script.h b/src/script/script.h
index 8d507f61db60..2a10393c3a43 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -588,6 +588,19 @@ class CScript : public CScriptBase
     }
 };
 
+/** Byte offsets of the OP_IF/OP_NOTIF whose first part, and the OP_ELSE whose part, a constant guard makes unreachable */
+struct DeadParts {
+    std::vector<bool> at_if, at_else;
+};
+
+/**
+ * Follow the script as far as constants determine it and mark the conditional
+ * parts that can never run. Anything read from the witness, a signature check,
+ * a hash or an opcode not modeled here is unknown, and an unknown condition
+ * marks nothing, so a spendable script is never read as dead.
+ */
+DeadParts FindDeadParts(const CScript& script);
+
 struct CScriptWitness
 {
     // Note that this encodes the data elements being pushed, rather than
diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
index 8481b85a5bf2..a6d3363cae20 100644
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -38,6 +38,7 @@ add_executable(fuzz
   crypto_hkdf_hmac_sha256_l32.cpp
   crypto_poly1305.cpp
   cuckoocache.cpp
+  datacarrier_dead_branch.cpp
   decode_tx.cpp
   descriptor_parse.cpp
   deserialize.cpp
diff --git a/src/test/fuzz/datacarrier_dead_branch.cpp b/src/test/fuzz/datacarrier_dead_branch.cpp
new file mode 100644
index 000000000000..11d26dbec44d
--- /dev/null
+++ b/src/test/fuzz/datacarrier_dead_branch.cpp
@@ -0,0 +1,144 @@
+// Copyright (c) 2026 The Bitcoin Knots developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <algorithm>
+#include <cassert>
+#include <optional>
+#include <vector>
+
+namespace {
+/**
+ * The non-standard count of CScript::DatacarrierBytes before the dead-branch
+ * rule. The first member is set where that function returned early with both
+ * counts; the unproven pubkey count is otherwise left to the real function,
+ * since the rule does not touch it.
+ */
+std::pair<std::optional<size_t>, size_t> ReferenceDatacarrierBytes(const CScript& self, const size_t remaining_outputs, const CScriptWitness* witness)
+{
+    if (size_t olga_bytes = self.IsOLGA(remaining_outputs); olga_bytes) {
+        return {size_t{0}, olga_bytes};
+    }
+
+    if (witness) {
+        if (uint32_t opnet_bytes = self.OPNetWitnessSize(*witness); opnet_bytes) {
+            return {size_t{0}, opnet_bytes};
+        }
+    }
+
+    size_t counted{0};
+    opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
+    std::vector<unsigned char> push_data;
+    unsigned int inside_noop{0}, inside_conditional{0};
+    auto is_push = [](opcodetype op) { return op <= OP_16 && op != OP_RESERVED; };
+    CScript::const_iterator opcode_it = self.begin(), data_began = self.begin();
+    for (CScript::const_iterator it = self.begin(); it < self.end(); last_opcode = opcode) {
+        opcode_it = it;
+        if (!self.GetOp(it, opcode, push_data)) {
+            return {size_t{0}, self.size()};
+        }
+
+        if (opcode == OP_IF || opcode == OP_NOTIF) {
+            ++inside_conditional;
+        } else if (opcode == OP_ENDIF) {
+            if (!inside_conditional) return {size_t{0}, self.size()};
+            --inside_conditional;
+        } else if (opcode == OP_RETURN && !inside_conditional) {
+            return {self.size(), size_t{0}};
+        }
+
+        if (inside_noop) {
+            switch (opcode) {
+            case OP_IF: case OP_NOTIF:
+                ++inside_noop;
+                break;
+            case OP_ENDIF:
+                if (0 == --inside_noop) {
+                    counted += it - data_began + 1;
+                }
+                break;
+            default: /* do nothing */;
+            }
+        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+            inside_noop = 1;
+            data_began = opcode_it;
+        } else if (is_push(opcode)) {
+            if (!is_push(last_opcode)) data_began = opcode_it;
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && is_push(last_opcode)) {
+            counted += it - data_began;
+        }
+    }
+    return {std::nullopt, counted};
+}
+
+bool Runs(const CScript& script, const std::vector<std::vector<unsigned char>>& initial)
+{
+    std::vector<std::vector<unsigned char>> stack{initial};
+    return EvalScript(stack, script, SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_STRICTENC | SCRIPT_VERIFY_MINIMALDATA | SCRIPT_VERIFY_MINIMALIF | SCRIPT_VERIFY_NULLFAIL,
+                      BaseSignatureChecker(), SigVersion::WITNESS_V0);
+}
+} // namespace
+
+FUZZ_TARGET(datacarrier_dead_branch)
+{
+    FuzzedDataProvider fdp{buffer.data(), buffer.size()};
+    const CScript script{ConsumeScript(fdp)};
+    const size_t remaining{fdp.ConsumeIntegralInRange<size_t>(0, 8)};
+    std::optional<CScriptWitness> witness;
+    if (fdp.ConsumeBool()) {
+        witness.emplace();
+        const size_t n{fdp.ConsumeIntegralInRange<size_t>(0, 6)};
+        for (size_t i{0}; i < n; ++i) witness->stack.push_back(ConsumeRandomLengthByteVector(fdp, 80));
+    }
+    const CScriptWitness* w{witness ? &*witness : nullptr};
+
+    // With the rule off the count is the old one, and the rule never changes the unproven pubkey count
+    const auto off{script.DatacarrierBytes(remaining, w, false)};
+    const auto on{script.DatacarrierBytes(remaining, w, true)};
+    const auto [early, ref_counted] = ReferenceDatacarrierBytes(script, remaining, w);
+    assert(off.second == ref_counted);
+    if (early) assert(off.first == *early);
+    assert(on.first == off.first);
+    assert(on.second <= std::max<size_t>(script.size(), ref_counted));
+
+    // A part marked dead never runs: an OP_RETURN put at its start leaves the interpreter's verdict
+    // unchanged, whatever the initial stack. An OP_NOP at the same spot is the control, so the two
+    // verdicts differ only if that part runs.
+    const DeadParts dead{FindDeadParts(script)};
+    std::vector<std::vector<unsigned char>> initial;
+    const size_t items{fdp.ConsumeIntegralInRange<size_t>(0, 4)};
+    for (size_t i{0}; i < items; ++i) initial.push_back(ConsumeRandomLengthByteVector(fdp, 8));
+    if (script.size() < MAX_SCRIPT_SIZE) {
+        opcodetype opcode;
+        for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+            const size_t offset{size_t(it - script.begin())};
+            if (!script.GetOp(it, opcode)) break;
+            if (!dead.at_if[offset] && !dead.at_else[offset]) continue;
+            CScript control{script.begin(), it}, probe{script.begin(), it};
+            control << OP_NOP;
+            probe << OP_RETURN;
+            control.insert(control.end(), it, script.end());
+            probe.insert(probe.end(), it, script.end());
+            assert(Runs(probe, initial) == Runs(control, initial));
+        }
+    }
+
+    // Balanced and without OP_ELSE, the rule finds at least what the envelope rule did
+    bool has_else{false}, balanced{true};
+    int depth{0};
+    opcodetype op;
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        if (!script.GetOp(it, op)) { balanced = false; break; }
+        if (op == OP_ELSE) has_else = true;
+        if (op == OP_IF || op == OP_NOTIF) ++depth;
+        if (op == OP_ENDIF && --depth < 0) balanced = false;
+    }
+    if (depth != 0) balanced = false;
+    if (balanced && !has_else && ref_counted > 0) assert(on.second > 0);
+}