diff --git a/src/script/script.cpp b/src/script/script.cpp
index fbb52fee7f9b..25b0c76b1216 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -8,10 +8,12 @@
 #include <crypto/common.h>
 #include <crypto/hex_base.h>
 #include <hash.h>
+#include <pubkey.h>
 #include <script/interpreter.h>
 #include <uint256.h>
 #include <util/hash_type.h>
 
+#include <algorithm>
 #include <string>
 
 CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
@@ -356,6 +358,333 @@ size_t CScript::OPNetWitnessSize(const CScriptWitness& witness) const
     return stack[0].size() + stack[3].size() - deduct;
 }
 
+/** Value of OP_1..OP_16, or -1 for any other opcode. CScript::DecodeOP_N asserts instead. */
+static int SmallIntValue(const opcodetype opcode)
+{
+    if (opcode < OP_1 || opcode > OP_16) return -1;
+    return int{opcode} - int{OP_1 - 1};
+}
+
+/** The m or n of an m-of-n, which above 16 is a minimal one byte push rather than an OP_N. */
+static int MultisigCount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode == 1 && push_data.size() == 1 && push_data[0] > 16 && push_data[0] <= MAX_PUBKEYS_PER_MULTISIG) {
+        return push_data[0];
+    }
+    return -1;
+}
+
+/**
+ * The k of a tapscript k-of-n, which allows far more keys than OP_CHECKMULTISIG does.
+ *
+ * A k from 1 to 16 is an OP_N as usual. Beyond the range OP_N reaches, k is instead a minimal
+ * push of the number: one byte up to 127, two beyond that, since a third would only ever hold
+ * the sign of a count that cannot be negative.
+ */
+static int MultiACount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode != 1 && opcode != 2) return -1;
+    if (push_data.size() != static_cast<size_t>(opcode)) return -1;
+    // The sign bit is never set here, and a zero high byte is minimal only where it keeps the
+    // byte below it from reading as the sign, as in 128 written 80 00.
+    if (push_data.back() & 0x80) return -1;
+    if (push_data.back() == 0 && (push_data.size() == 1 || !(push_data[0] & 0x80))) return -1;
+    int value{push_data[0]};
+    if (push_data.size() == 2) value |= int{push_data[1]} << 8;
+    if (value <= 16 || value > int{MAX_PUBKEYS_PER_MULTI_A}) return -1;
+    return value;
+}
+
+static bool IsPubkeyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (opcode > OP_PUSHDATA4) return false;
+    return push_data.size() == CPubKey::COMPRESSED_SIZE || push_data.size() == CPubKey::SIZE;
+}
+
+/** A 32 byte push, which is an x-only key where a checksig-family opcode claims it as one. */
+static bool IsXOnlyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    return opcode <= OP_PUSHDATA4 && push_data.size() == XOnlyPubKey::size();
+}
+
+/** Opcodes that leave the stack as they found it, so the key below them is still on top. */
+static bool IsStackNeutralNop(const opcodetype opcode)
+{
+    return opcode == OP_NOP || (opcode >= OP_NOP1 && opcode <= OP_NOP10);
+}
+
+/** Opcodes that neither read the stack nor change it. A timelock check reads the number on top. */
+static bool IsNoOp(const opcodetype opcode)
+{
+    return opcode == OP_CODESEPARATOR || (IsStackNeutralNop(opcode) && opcode != OP_CHECKLOCKTIMEVERIFY && opcode != OP_CHECKSEQUENCEVERIFY);
+}
+
+/** A push of 5 bytes or less, which is a number where the opcode after it reads one. */
+static bool IsShortPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    return opcode <= OP_PUSHDATA4 && push_data.size() <= 5;
+}
+
+/** Mirror of the push run the caller counts when it is balanced by a drop. */
+static bool IsRunPush(const opcodetype opcode)
+{
+    return opcode <= OP_16 && opcode != OP_RESERVED;
+}
+
+/**
+ * Signature-shaped witness items: a DER signature plus its sighash byte, or a BIP340 one.
+ *
+ * The last item is the script or the control block of the spend, never a signature.
+ */
+static size_t CountWitnessSignatures(const CScriptWitness& witness)
+{
+    size_t count{0};
+    for (size_t i{0}; i + 1 < witness.stack.size(); ++i) {
+        const size_t size{witness.stack[i].size()};
+        if (size >= 64 && size <= 73) ++count;
+    }
+    return count;
+}
+
+/** The size of the digest an opcode hashes the top item into, or 0 for any other opcode. */
+static size_t DigestSize(const opcodetype opcode)
+{
+    switch (opcode) {
+    case OP_RIPEMD160: case OP_SHA1: case OP_HASH160: return 20;
+    case OP_SHA256: case OP_HASH256: return 32;
+    default: return 0;
+    }
+}
+
+/**
+ * A push of 6 or more bytes that is no key a spend can check: longer than any number a script reads,
+ * and neither a compressed key nor, outside a witness script, an uncompressed one. Segwit policy refuses
+ * an uncompressed key wherever it checks one, so in a witness script 65 bytes is never a key either.
+ */
+static bool IsOddPush(const opcodetype opcode, const std::vector<unsigned char>& push_data, const bool witness_script)
+{
+    if (opcode > OP_PUSHDATA4 || push_data.size() <= 5 || push_data.size() == CPubKey::COMPRESSED_SIZE) return false;
+    return witness_script || push_data.size() != CPubKey::SIZE;
+}
+
+/**
+ * Bytes of the odd pushes in a push run that ends at `next`, less those something else accounts for.
+ * A hash lock compares a digest with OP_EQUAL or OP_EQUALVERIFY: the last push of the run, sized as
+ * the hash opcode before it outputs. The caller counts a run that a drop balances.
+ */
+static size_t OddRunBytes(const size_t run_bytes, const size_t last_bytes, const bool last_is_digest, const opcodetype next)
+{
+    if ((next == OP_EQUAL || next == OP_EQUALVERIFY) && last_is_digest) return run_bytes - last_bytes;
+    if (next == OP_DROP || next == OP_2DROP) return 0;
+    return run_bytes;
+}
+
+/**
+ * Bytes a script carries in pubkeys that no signature can prove.
+ *
+ * A key in an m-of-n that nothing signs for authorizes nothing, so what it holds is payload
+ * rather than a spending condition. That is how a file is published as a chain of ground
+ * secp256k1 points, each carrying 31 bytes and hiding behind a hash until it is spent. Ordinary
+ * multisig carries a couple of such keys itself, hence the tolerance.
+ *
+ * A key slot the spend never examines takes a push of any size, not only a key, so in a script that
+ * runs OP_CHECKMULTISIG every odd push counts as data in full, outside the tolerance. So does a short
+ * push with another push after it, no-ops aside: a script reads a number with the opcode after it, and
+ * only a key count sits under keys, so a key count is left alone. None of the multisig spends
+ * from block 961640 to 977870 has either that a hash lock, a drop or an OP_FALSE OP_IF envelope does
+ * not account for, and none in a witness script has a 65 byte push.
+ */
+static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* witness)
+{
+    /** Unproven pubkeys a script may carry before the rest are counted as data. Set so that ordinary
+     *  multisig, including wide federations, is charged nothing at all: the budget is per
+     *  transaction, so any per-input charge accumulates across inputs and would reject real spends. */
+    static constexpr size_t MAX_UNPROVEN_PUBKEYS{10};
+
+    size_t pubkeys{0}, provable{0};
+    // The current run of adjacent pubkey pushes, and the count that opened it. A well-formed
+    // m-of-n closes as <m> <pubkey>*n <n> OP_CHECKMULTISIG, and only that shape credits m.
+    size_t run_keys{0};
+    // Keys in the current push run, which the caller counts whole if a drop balances it.
+    size_t push_run_keys{0};
+    // The current run of a tapscript k-of-n, which names its keys one at a time as
+    // <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)* <k> OP_NUMEQUAL. Only that shape credits k.
+    size_t multi_a_keys{0};
+    int run_opened_by{-1}, last_count{-1}, last_a_count{-1};
+    unsigned int inside_noop{0};
+    bool last_is_push{false};
+    // Whether the item before this one was a key a checksig-family opcode can still claim, and
+    // whether it was the 32 byte kind that is only a key because one does.
+    bool last_is_key{false}, last_is_xonly{false};
+    opcodetype opcode{OP_INVALIDOPCODE}, last_opcode{OP_INVALIDOPCODE};
+    std::vector<unsigned char> push_data;
+    // Odd pushes counted so far, and those of the current push run, which its end decides.
+    size_t odd_bytes{0}, odd_run_bytes{0}, odd_last_bytes{0};
+    bool odd_last_is_digest{false};
+    // The last short push, which counts if a push comes next, and whether a no-op has come between,
+    // which leaves it outside the push run that the next push is in.
+    size_t short_bytes{0};
+    bool short_carried{false};
+
+    // Odd pushes are this rule's only where the script runs OP_CHECKMULTISIG. A redeem script comes
+    // with an empty witness, so a script with witness items here is a witness script.
+    bool has_multisig{false};
+    {
+        unsigned int envelope{0};
+        opcodetype op, last{OP_INVALIDOPCODE};
+        std::vector<unsigned char> data;
+        for (CScript::const_iterator it{script.begin()}; it < script.end(); last = op) {
+            if (!script.GetOp(it, op, data)) return 0;
+            if (envelope) {
+                if (op == OP_IF || op == OP_NOTIF) {
+                    ++envelope;
+                } else if (op == OP_ENDIF) {
+                    --envelope;
+                }
+            } else if (op == OP_IF && last == OP_FALSE) {
+                envelope = 1;
+            } else if (op == OP_CHECKMULTISIG || op == OP_CHECKMULTISIGVERIFY) {
+                has_multisig = true;
+            }
+        }
+    }
+    const bool segwit_multisig{has_multisig && witness && !witness->stack.empty()};
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        // The caller counts an unparsable script whole, and the iterator may not have advanced.
+        if (!script.GetOp(it, opcode, push_data)) return 0;
+        const bool enveloped{inside_noop != 0};
+        const bool is_pubkey{IsPubkeyPush(opcode, push_data) && !(segwit_multisig && push_data.size() == CPubKey::SIZE)};
+        const bool is_xonly{IsXOnlyPush(opcode, push_data)};
+        const int count{MultisigCount(opcode, push_data)};
+        const int a_count{MultiACount(opcode, push_data)};
+        bool is_key{false};
+
+        if (inside_noop) {
+            // A closed OP_FALSE OP_IF envelope is counted whole by the caller, so skip over it.
+            if (opcode == OP_IF || opcode == OP_NOTIF) {
+                ++inside_noop;
+            } else if (opcode == OP_ENDIF) {
+                --inside_noop;
+            }
+        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+            inside_noop = 1;
+        } else if (is_pubkey) {
+            if (!run_keys) run_opened_by = last_count;
+            ++run_keys;
+            ++push_run_keys;
+            ++pubkeys;
+            is_key = true;
+        } else if (is_xonly) {
+            // Nothing tells an x-only key from a hash but the opcode that spends it, so this
+            // one is counted where a checksig-family opcode claims it rather than here. It
+            // stays out of the push run for the same reason: a drop never reaches it.
+            run_keys = 0;
+            is_key = true;
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && last_is_push) {
+            // The caller counts the whole run as dropped data, so do not charge it again.
+            pubkeys -= push_run_keys;
+            run_keys = 0;
+            multi_a_keys = 0;
+        } else if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY) {
+            if (last_is_xonly) ++pubkeys;
+            ++provable;
+            run_keys = 0;
+            // <pubkey> OP_CHECKSIG opens a tapscript k-of-n; anything else there ends one.
+            multi_a_keys = (last_is_key && opcode == OP_CHECKSIG) ? 1 : 0;
+        } else if (opcode == OP_CHECKSIGADD) {
+            if (last_is_xonly) ++pubkeys;
+            // The run is credited the k it closes on, so a key earns nothing on its own here.
+            multi_a_keys = (multi_a_keys && last_is_key) ? multi_a_keys + 1 : 0;
+            run_keys = 0;
+        } else if ((opcode == OP_NUMEQUAL || opcode == OP_NUMEQUALVERIFY) && multi_a_keys) {
+            // Padding or reordering the keys forfeits the credit rather than earning one, and
+            // so does naming a k the run cannot satisfy. The OP_CHECKSIG that opened the run
+            // has credited one of the k already.
+            if (last_a_count > 0 && size_t(last_a_count) <= multi_a_keys) {
+                provable += size_t(last_a_count) - 1;
+            }
+            multi_a_keys = 0;
+            run_keys = 0;
+        } else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY) {
+            // Padding or reordering the keys forfeits the credit rather than earning one.
+            if (run_opened_by > 0 && last_count > 0 && size_t(last_count) == run_keys) {
+                provable += size_t(run_opened_by);
+            }
+            run_keys = 0;
+            multi_a_keys = 0;
+        } else if (count < 0) {
+            // A key count sits on both ends of a multisig, so it does not break the run.
+            run_keys = 0;
+            if (a_count < 0) multi_a_keys = 0;
+        }
+
+        const bool is_push{IsRunPush(opcode)};
+        if (!is_push) push_run_keys = 0;
+        // The caller counts an OP_FALSE OP_IF envelope whole, so what is inside it is left to the caller.
+        if (has_multisig && !enveloped) {
+            if (is_push) {
+                // The short push before this one is no number, so it joins the run the caller may
+                // count as dropped, unless a no-op ended that run first.
+                if (short_carried) {
+                    odd_bytes += short_bytes;
+                } else {
+                    odd_run_bytes += short_bytes;
+                }
+                short_bytes = IsShortPush(opcode, push_data) && count < 0 ? push_data.size() : 0;
+                short_carried = false;
+                odd_last_bytes = IsOddPush(opcode, push_data, segwit_multisig) ? push_data.size() : 0;
+                odd_last_is_digest = odd_last_bytes && DigestSize(last_opcode) == push_data.size();
+                odd_run_bytes += odd_last_bytes;
+            } else {
+                odd_bytes += OddRunBytes(odd_run_bytes, odd_last_bytes, odd_last_is_digest, opcode);
+                odd_run_bytes = odd_last_bytes = 0;
+                odd_last_is_digest = false;
+                // A no-op reads nothing, so the short push before it waits on the opcode after it.
+                if (IsNoOp(opcode)) {
+                    short_carried = true;
+                } else {
+                    short_bytes = 0;
+                }
+            }
+        }
+        // An opcode that leaves the stack as it found it leaves the key below it on top, so it
+        // cannot hide that key from the opcode which spends it. It still breaks the run above:
+        // padding a k-of-n is what forfeits its credit.
+        if (!IsStackNeutralNop(opcode)) {
+            last_is_key = is_key;
+            last_is_xonly = is_xonly && !inside_noop;
+        }
+        last_opcode = opcode;
+        last_count = count;
+        last_a_count = a_count;
+        last_is_push = is_push;
+    }
+
+    // A script can name more signatures than the spender supplies, including in branches that
+    // never run. Where the witness carries the spend it is the honest count; a P2SH spend leaves
+    // its signatures in the scriptSig, which is not visible here.
+    //
+    // A taproot script-path spend trails the script with a control block and, only when one is
+    // present, an annex, but CountWitnessSignatures excludes only the true last item. A control
+    // block can fall in the 64-73 byte range at a shallow merkle depth, so when an annex pushes
+    // it off the end, it may be miscounted as a signature. That can only inflate the count this
+    // rule caps against, never shrink it, so it can only undercharge, never overcharge: a
+    // documented imprecision, not a bug.
+    if (witness && !witness->stack.empty()) {
+        provable = std::min(provable, CountWitnessSignatures(*witness));
+    }
+
+    if (has_multisig) odd_bytes += OddRunBytes(odd_run_bytes, odd_last_bytes, odd_last_is_digest, OP_INVALIDOPCODE);
+
+    if (pubkeys < provable + MAX_UNPROVEN_PUBKEYS) return odd_bytes;
+    // An uncompressed key carries no more payload than a compressed one, since only the x
+    // coordinate is free, so the compressed size is the unit.
+    return (pubkeys - provable - MAX_UNPROVEN_PUBKEYS) * CPubKey::COMPRESSED_SIZE + odd_bytes;
+}
+
 std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness) const
 {
     if (size_t olga_bytes = IsOLGA(remaining_outputs); olga_bytes) {
@@ -372,6 +701,7 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
     opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
     std::vector<unsigned char> push_data;
     unsigned int inside_noop{0}, inside_conditional{0};
+    auto is_push = [](opcodetype op) { return op <= OP_16 && op != OP_RESERVED; };  // OP_0..OP_16 push data/numbers
     CScript::const_iterator opcode_it = begin(), data_began = begin();
     for (CScript::const_iterator it = begin(); it < end(); last_opcode = opcode) {
         opcode_it = it;
@@ -406,14 +736,14 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
         } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
             inside_noop = 1;
             data_began = opcode_it;
-        // Match <data> OP_DROP
-        } else if (opcode <= OP_PUSHDATA4) {
-            data_began = opcode_it;
-        } else if (opcode == OP_DROP && last_opcode <= OP_PUSHDATA4) {
+        // Match <data> OP_DROP, or a run of <data>/pushnums ... OP_DROP/OP_2DROP (bare/BIP-110 envelope)
+        } else if (is_push(opcode)) {
+            if (!is_push(last_opcode)) data_began = opcode_it;  // only reset at the start of a push run
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && is_push(last_opcode)) {
             counted += it - data_began;
         }
     }
-    return {0, counted};
+    return {UnprovenPubkeyBytes(*this, witness), counted};
 }
 
 bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator end, opcodetype& opcodeRet, std::vector<unsigned char>* pvchRet)
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index 07a49e039fb8..00aa961b0ea1 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -93,6 +93,14 @@ FUZZ_TARGET(script, .init = initialize_script)
     std::vector<std::vector<unsigned char>> solutions;
     (void)Solver(script, solutions);
 
+    {
+        CScriptWitness witness;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            witness.stack.push_back(ConsumeRandomLengthByteVector(fuzzed_data_provider));
+        }
+        (void)script.DatacarrierBytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4),
+                                      witness.stack.empty() ? nullptr : &witness);
+    }
     (void)script.HasValidOps();
     (void)script.IsPayToAnchor();
     (void)script.IsPayToScriptHash();
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 4b9ae35722a2..4c1838e2794e 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1503,6 +1503,62 @@ static std::string DatacarrierBytesStr(const CScript &script, const size_t remai
     return strprintf("%s+%s", dcb.first, dcb.second);
 }
 
+static std::string DatacarrierBytesStr(const CScript& script, const CScriptWitness& witness)
+{
+    auto dcb = script.DatacarrierBytes(0, &witness);
+    return strprintf("%s+%s", dcb.first, dcb.second);
+}
+
+/** <m> <pubkey>*n <n> OP_CHECKMULTISIG, with distinct keys of the given size. */
+static CScript MultisigScript(const int m, const int n, const size_t key_size = 33)
+{
+    // CScript's operator<< encodes an int above 16 as a minimal push, as a real multisig does.
+    CScript script{CScript() << m};
+    for (int i{0}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, i + 1);
+    }
+    return script << n << OP_CHECKMULTISIG;
+}
+
+/** A witness offering sigs signatures, as a spend of the given script would. */
+static CScriptWitness MultisigWitness(const int sigs, const CScript& script)
+{
+    CScriptWitness witness;
+    witness.stack.emplace_back(); // the CHECKMULTISIG dummy
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(72, i + 1);
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    return witness;
+}
+
+/** <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)*(n-1) <k> OP_NUMEQUAL, tapscript's k-of-n. */
+static CScript MultiAScript(const int k, const int n, const size_t key_size = 32,
+                            const opcodetype terminator = OP_NUMEQUAL)
+{
+    CScript script{CScript() << std::vector<unsigned char>(key_size, 1) << OP_CHECKSIG};
+    for (int i{1}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, static_cast<unsigned char>(i + 1)) << OP_CHECKSIGADD;
+    }
+    return script << k << terminator;
+}
+
+/** A tapscript witness offering sigs signatures, as a spend of the given k-of-n would. */
+static CScriptWitness TapscriptWitness(const int sigs, const int n, const CScript& script)
+{
+    CScriptWitness witness;
+    // A key the spend does not sign for leaves an empty stack item in place of its signature.
+    for (int i{0}; i < n - sigs; ++i) {
+        witness.stack.emplace_back();
+    }
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(64, i + 1); // a BIP340 signature, which carries no sighash byte
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    witness.stack.emplace_back(33, 0xc0); // the control block of a depth zero taproot leaf
+    return witness;
+}
+
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
 {
     using zeros = std::vector<unsigned char>;
@@ -1525,6 +1581,10 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_TRUE << OP_IF << OP_ENDIF << OP_ENDIF));
     // pushing then immediately dropping is data: length(1), zero(11), OP_DROP
     BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP));
+    // bare/BIP-110 envelope: a run of pushes balanced by OP_2DROP is all data
+    BOOST_CHECK_EQUAL("0+25", DatacarrierBytesStr(CScript() << zeros(11) << zeros(11) << OP_2DROP));
+    // pushnums interleaved in the run don't strand earlier pushes: 12 + 1 (OP_7) + 12 + 1 (OP_2DROP)
+    BOOST_CHECK_EQUAL("0+26", DatacarrierBytesStr(CScript() << zeros(11) << OP_7 << zeros(11) << OP_2DROP));
     // OLGA data obfuscated as p2wsh
     const auto olga_header = CScript() << OP_0 << "003e7374616d703a000000000000000000000000000000000000000000000000"_hex;
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 2));
@@ -1534,6 +1594,335 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 3));
 }
 
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // A key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(33) << OP_CHECKSIG));
+    // Ordinary multisig is charged nothing, however wide, because the budget is per transaction
+    // and any per-input charge would accumulate across the inputs of a real spend
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 6)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 9)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(11, 15)));
+    // Above 16 the key count is a minimal one byte push rather than an OP_N, and still counts
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(17, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(20, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(19, 20)));
+    // The boundary: eleven keys behind one signature is free, twelve starts paying
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 11)));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultisigScript(1, 12)));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15)));
+    // Uncompressed keys carry no more payload, so they are charged the same
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15, 65)));
+
+    // Naming signatures the spend does not offer earns nothing: OP_CHECKSIG in a branch that
+    // never runs would otherwise buy off the whole count for one byte each
+    CScript evasion{MultisigScript(1, 15)};
+    evasion << OP_IF << OP_1 << OP_ELSE;
+    for (int i{0}; i < 15; ++i) {
+        evasion << OP_CHECKSIG;
+    }
+    evasion << OP_ENDIF;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(evasion));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(evasion, MultisigWitness(1, evasion)));
+    // A real 11-of-15 spend is charged nothing whether or not the witness is seen
+    const CScript multisig{MultisigScript(11, 15)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, MultisigWitness(11, multisig)));
+    // An empty witness means the signatures are elsewhere (P2SH), so the script is believed
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, CScriptWitness()));
+    // The witnessScript itself is not a signature, however close to one in size
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(0, MultisigScript(1, 15))));
+    // ... whereas offering one signature for the same script leaves fourteen keys unproven
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(multisig, MultisigWitness(1, multisig)));
+
+    // Breaking the key run forfeits the m credit rather than earning one
+    CScript padded{CScript() << OP_1};
+    for (int i{0}; i < 15; ++i) {
+        padded << zeros(33) << OP_NOP;
+    }
+    padded << CScript::EncodeOP_N(15) << OP_CHECKMULTISIG;
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(padded));
+
+    // A dropped key is already counted as dropped data; it is not charged twice
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(33) << OP_DROP));
+    // A drop balancing the run discounts every key in it, whatever sits at the end of the run
+    BOOST_CHECK_EQUAL("0+105", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33) << 20 << OP_DROP));
+    BOOST_CHECK_EQUAL("0+36", DatacarrierBytesStr(CScript() << zeros(33) << OP_1 << OP_DROP));
+    // Keys inside an OP_FALSE OP_IF envelope are counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33) << OP_ENDIF));
+    // An envelope that never closes is counted by neither rule. It cannot execute, so it is
+    // unspendable as a witness or redeem script and nonstandard as a scriptPubKey.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33)
+                                                           << zeros(33) << zeros(33)));
+    // A bare envelope carries no pubkeys at all, so this rule must charge nothing for it
+    BOOST_CHECK_EQUAL("0+90", DatacarrierBytesStr(CScript() << std::vector<unsigned char>{'o', 'r', 'd'}
+                                                            << zeros(83) << OP_2DROP << OP_1));
+    // A run of keys balanced by drops is counted as dropped data, so it is not charged again
+    BOOST_CHECK_EQUAL("0+171", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33)
+                                                             << zeros(33) << zeros(33)
+                                                             << OP_2DROP << OP_2DROP << OP_DROP));
+}
+
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_odd_key_slots)
+{
+    using zeros = std::vector<unsigned char>;
+    const zeros key(33, 2);
+    // 1-of-15 with the signing key last: consensus never examines the 14 slots before it, so they
+    // take any push. Each odd push counts in full.
+    auto slots = [&](const size_t size, const opcodetype between = OP_INVALIDOPCODE) {
+        CScript script{CScript() << OP_1};
+        for (int i{0}; i < 14; ++i) {
+            script << zeros(size);
+            if (between != OP_INVALIDOPCODE) script << between;
+        }
+        return script << key << CScript::EncodeOP_N(15) << OP_CHECKMULTISIG;
+    };
+    BOOST_CHECK_EQUAL("518+0", DatacarrierBytesStr(slots(37)));
+    BOOST_CHECK_EQUAL("1400+0", DatacarrierBytesStr(slots(100)));
+    BOOST_CHECK_EQUAL("518+0", DatacarrierBytesStr(slots(37), MultisigWitness(1, slots(37))));
+    // No way of writing the multisig hides them: a computed key count, or a no-op between the slots
+    {
+        CScript computed{CScript() << OP_1};
+        for (int i{0}; i < 14; ++i) computed << zeros(37);
+        computed << key << OP_8 << OP_7 << OP_ADD << OP_CHECKMULTISIG;
+        BOOST_CHECK_EQUAL("518+0", DatacarrierBytesStr(computed));
+    }
+    BOOST_CHECK_EQUAL("518+0", DatacarrierBytesStr(slots(37, OP_NOP)));
+    // Slots shorter than 6 bytes count too, since another push follows each of them, even across
+    // no-ops. Any other opcode after them leaves them alone, as a timelock check does.
+    BOOST_CHECK_EQUAL("70+0", DatacarrierBytesStr(slots(5)));
+    BOOST_CHECK_EQUAL("14+0", DatacarrierBytesStr(slots(1)));
+    BOOST_CHECK_EQUAL("70+0", DatacarrierBytesStr(slots(5, OP_NOP)));
+    BOOST_CHECK_EQUAL("70+0", DatacarrierBytesStr(slots(5, OP_CODESEPARATOR)));
+    BOOST_CHECK_EQUAL("70+0", DatacarrierBytesStr(slots(5), MultisigWitness(1, slots(5))));
+    {
+        CScript computed{CScript() << OP_1};
+        for (int i{0}; i < 14; ++i) computed << zeros(5);
+        computed << key << OP_8 << OP_7 << OP_ADD << OP_CHECKMULTISIG;
+        BOOST_CHECK_EQUAL("70+0", DatacarrierBytesStr(computed));
+    }
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(slots(5, OP_CHECKSEQUENCEVERIFY)));
+    // Real keys among the slots still count past the allowance, and the odd push breaks the
+    // run, so m is not credited
+    {
+        CScript mixed{CScript() << OP_1};
+        for (int i{0}; i < 12; ++i) mixed << key;
+        mixed << zeros(37) << key << CScript::EncodeOP_N(14) << OP_CHECKMULTISIG;
+        BOOST_CHECK_EQUAL("136+0", DatacarrierBytesStr(mixed));
+    }
+    // A 32 byte push in a slot is no key there either
+    BOOST_CHECK_EQUAL("448+0", DatacarrierBytesStr(slots(32)));
+
+    // What real multisig scripts carry besides keys is left alone
+    // ... a hash lock: a digest the size its hash opcode outputs, compared with OP_EQUAL(VERIFY)
+    {
+        CScript htlc{CScript() << OP_HASH160 << zeros(20) << OP_EQUALVERIFY};
+        const CScript multisig{MultisigScript(2, 2)};
+        htlc.insert(htlc.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(htlc));
+        CScript sha{CScript() << OP_SHA256 << zeros(32) << OP_EQUAL << OP_NOTIF};
+        sha.insert(sha.end(), multisig.begin(), multisig.end());
+        sha << OP_ENDIF;
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(sha));
+    }
+    // ... a tag in an OP_FALSE OP_IF envelope after a 3-of-5, counted once, as the envelope
+    {
+        CScript tagged{MultisigScript(3, 5)};
+        tagged << OP_FALSE << OP_IF << zeros(32) << OP_ENDIF;
+        BOOST_CHECK_EQUAL("0+36", DatacarrierBytesStr(tagged));
+    }
+    // ... a dropped push, counted once, by the drop rule
+    {
+        CScript dropped{CScript() << zeros(32) << OP_DROP};
+        const CScript multisig{MultisigScript(2, 3)};
+        dropped.insert(dropped.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("0+34", DatacarrierBytesStr(dropped));
+    }
+    // ... numbers, up to the 5 bytes a timelock reads; a 6 byte push is no number
+    {
+        CScript timelocked{MultisigScript(2, 3)};
+        timelocked << OP_NOTIF << zeros(5, 1) << OP_CHECKSEQUENCEVERIFY << OP_ENDIF;
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(timelocked));
+        CScript six{MultisigScript(2, 3)};
+        six << OP_NOTIF << zeros(6, 1) << OP_CHECKSEQUENCEVERIFY << OP_ENDIF;
+        BOOST_CHECK_EQUAL("6+0", DatacarrierBytesStr(six));
+    }
+    // ... a timelock number with a multisig after the check, which reads it
+    {
+        CScript timelock_first{CScript() << zeros(3, 1) << OP_CHECKSEQUENCEVERIFY};
+        const CScript multisig{MultisigScript(2, 3)};
+        timelock_first.insert(timelock_first.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(timelock_first));
+    }
+    // ... a key count above 16, a one byte push with a key after it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(17, 20)));
+    // ... uncompressed keys
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 3, 65)));
+    // ... a run of pushes an OP_2DROP balances, counted once, as dropped data
+    {
+        CScript two{CScript() << zeros(20) << zeros(20) << OP_2DROP};
+        const CScript multisig{MultisigScript(2, 3)};
+        two.insert(two.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("0+43", DatacarrierBytesStr(two));
+        // Short pushes in a dropped run are the drop rule's alone, and one a no-op keeps out of
+        // the run is this rule's
+        CScript short_two{CScript() << zeros(5) << zeros(5) << OP_2DROP};
+        short_two.insert(short_two.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(short_two));
+        CScript short_one{CScript() << zeros(5) << zeros(5) << OP_DROP};
+        short_one.insert(short_one.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(short_one));
+        CScript short_nop{CScript() << zeros(5) << OP_NOP << zeros(5) << OP_2DROP};
+        short_nop.insert(short_nop.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("5+7", DatacarrierBytesStr(short_nop));
+    }
+    // OP_EQUAL alone makes no hash lock: a push it compares counts unless a hash opcode of its size
+    // comes before it, so OP_EQUAL OP_DROP cannot carry data past the rule
+    {
+        CScript equal;
+        for (int i{0}; i < 5; ++i) equal << OP_1 << zeros(255) << OP_EQUAL << OP_DROP;
+        const CScript multisig{MultisigScript(1, 1)};
+        equal.insert(equal.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("1275+0", DatacarrierBytesStr(equal));
+        CScript dup{CScript() << OP_DUP << zeros(20) << OP_EQUALVERIFY};
+        dup.insert(dup.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("20+0", DatacarrierBytesStr(dup));
+        CScript wrong_size{CScript() << OP_SHA256 << zeros(20) << OP_EQUALVERIFY};
+        wrong_size.insert(wrong_size.end(), multisig.begin(), multisig.end());
+        BOOST_CHECK_EQUAL("20+0", DatacarrierBytesStr(wrong_size));
+    }
+    // OP_CHECKMULTISIGVERIFY makes it a multisig script as OP_CHECKMULTISIG does
+    {
+        CScript verify{CScript() << OP_1};
+        for (int i{0}; i < 14; ++i) verify << zeros(37);
+        verify << key << CScript::EncodeOP_N(15) << OP_CHECKMULTISIGVERIFY << OP_1;
+        BOOST_CHECK_EQUAL("518+0", DatacarrierBytesStr(verify));
+    }
+    // In a witness script 65 bytes is no key either, since segwit policy refuses an uncompressed key
+    // it checks: ten such slots before the signing key count in full. A redeem script may use them.
+    {
+        CScript wide{CScript() << OP_1};
+        for (int i{0}; i < 10; ++i) wide << zeros(65, 4);
+        wide << key << CScript::EncodeOP_N(11) << OP_CHECKMULTISIG;
+        BOOST_CHECK_EQUAL("650+0", DatacarrierBytesStr(wide, MultisigWitness(1, wide)));
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(wide));
+        // A P2SH spend passes an empty witness: that is a redeem script, where 65 bytes is a key
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(wide, CScriptWitness()));
+    }
+    // A script without OP_CHECKMULTISIG is not this rule's to judge
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(37) << zeros(37) << OP_EQUAL));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(5) << zeros(5) << OP_EQUAL));
+}
+
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_tapscript_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // The same payload costs the same whichever way it is written. A 1-of-15 under P2WSH and
+    // the taproot leaf that says the same thing are charged alike, where once the leaf was free
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(1, MultisigScript(1, 15))));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(1, 15), TapscriptWitness(1, 15, MultiAScript(1, 15))));
+
+    // An x-only key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG));
+    // Ordinary tapscript multisig keeps its spare keys, exactly as OP_CHECKMULTISIG does
+    for (const auto& [k, n] : {std::pair{2, 3}, std::pair{3, 5}, std::pair{1, 2}, std::pair{1, 3},
+                               std::pair{3, 3}, std::pair{5, 5}, std::pair{11, 15}, std::pair{20, 20}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n)),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Eleven keys behind one signature are free, as under OP_CHECKMULTISIG; past the tolerance
+    // every further key is payload, however honest the spend that offers it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 11), TapscriptWitness(1, 11, MultiAScript(1, 11))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(1, 12), TapscriptWitness(1, 12, MultiAScript(1, 12))));
+    BOOST_CHECK_EQUAL("66+0", DatacarrierBytesStr(MultiAScript(1, 13), TapscriptWitness(1, 13, MultiAScript(1, 13))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(5, 16), TapscriptWitness(5, 16, MultiAScript(5, 16))));
+    for (const auto& [k, n] : {std::pair{1, 11}, std::pair{1, 12}, std::pair{1, 13}, std::pair{5, 16}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n), MultisigWitness(k, MultisigScript(k, n))),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Above 16 the key count is a minimal push rather than an OP_N, and still counts. A leaf may
+    // hold far more keys than OP_CHECKMULTISIG, so it is read up to MAX_PUBKEYS_PER_MULTI_A
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(17, 28), TapscriptWitness(17, 28, MultiAScript(17, 28))));
+    // From 128 the minimal push carries a zero high byte to keep the sign clear, as in 80 00
+    for (const int k : {127, 128, 255, 256}) {
+        const CScript script{MultiAScript(k, k + 2)};
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(script, TapscriptWitness(k, k + 2, script)));
+    }
+    // ... while a zero high byte nothing needs is not minimal, and forfeits the credit
+    CScript non_minimal{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 28; ++i) {
+        non_minimal << zeros(32) << OP_CHECKSIGADD;
+    }
+    non_minimal << std::vector<unsigned char>{17, 0} << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("561+0", DatacarrierBytesStr(non_minimal, TapscriptWitness(17, 28, non_minimal)));
+    // The credit is the shape of the run, not the size of its keys: a leaf may hold either
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(3, 5, 33), TapscriptWitness(3, 5, MultiAScript(3, 5, 33))));
+    // A run closed by OP_NUMEQUALVERIFY says the same thing as one closed by OP_NUMEQUAL
+    const CScript verify{MultiAScript(3, 5, 32, OP_NUMEQUALVERIFY)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(verify, TapscriptWitness(3, 5, verify)));
+
+    // A 32 byte push is only a key where something spends it. The preimage of a hashlock and
+    // the hash it is checked against are neither of them keys, in a leaf or anywhere else
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SHA256 << zeros(32) << OP_EQUALVERIFY
+                                                           << zeros(33) << OP_CHECKSIG));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_SHA256 << zeros(32)
+                                                           << OP_EQUALVERIFY << zeros(32) << OP_CHECKSIG));
+
+    // Padding the run forfeits the credit rather than earning one, so an 11-of-15 written the
+    // long way round is charged as though it proved nothing but the key it opens on
+    CScript padded{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        padded << zeros(32) << OP_NOP << OP_CHECKSIGADD;
+    }
+    padded << 11 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(padded, TapscriptWitness(11, 15, padded)));
+    // ... while an OP_NOP does not hide the key beneath it from the opcode that spends it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_NOP << OP_CHECKSIG));
+
+    // Naming a k the run cannot satisfy forfeits the credit too
+    CScript inflated{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        inflated << zeros(32) << OP_CHECKSIGADD;
+    }
+    inflated << 20 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(inflated, TapscriptWitness(11, 15, inflated)));
+
+    // The OP_CHECKSIG a run opens on credits one of the k already, so a 1-of-n is credited once
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 3), TapscriptWitness(1, 3, MultiAScript(1, 3))));
+    // Naming more signatures than the spend offers earns nothing here as it does elsewhere
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(11, 15), TapscriptWitness(1, 15, MultiAScript(11, 15))));
+
+    // A key inside an OP_FALSE OP_IF envelope is counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(32)
+                                                            << OP_CHECKSIG << OP_ENDIF));
+    // A dropped key is already counted as dropped data; it is not charged twice, and no credit
+    // drives the count below zero
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG << zeros(33) << OP_DROP));
+    CScript over_credited{MultiAScript(3, 3)};
+    over_credited << OP_3 << OP_NUMEQUAL << OP_3 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(over_credited));
+
+    // A 32 byte push nothing spends and no drop balances is reached by neither rule. It is
+    // stranded on the stack, which leaves the leaf unspendable, so it buys nothing.
+    CScript stranded;
+    for (int i{0}; i < 15; ++i) {
+        stranded << zeros(32);
+    }
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(stranded));
+    // Balance the same pushes with drops and the run rule charges them whole
+    BOOST_CHECK_EQUAL("0+496", DatacarrierBytesStr(CScript{stranded} << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_DROP));
+}
+
 BOOST_AUTO_TEST_CASE(script_GetScriptForTransactionInput)
 {
     using zeros = std::vector<unsigned char>;
diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 7e00ff083525..1651179452cc 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -1037,8 +1037,10 @@ def big_spend_inputs(ctx):
     add_spender(spenders, "tapscript/emptysigs/checksig", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t13"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/nochecksigverify", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t20"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/checksigadd", leaf="t14", **common, inputs=[b'', getter("sign")], failure={"leaf": "t15"}, **ERR_UNKNOWN_PUBKEY)
-    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable.
-    add_spender(spenders, "tapscript/no10000limit", leaf="t19", **SINGLE_SIG, **common)
+    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable by consensus.
+    # The leaf opens with 10001 repeats of OP_0 OP_0 OP_2DROP, which datacarrier policy counts as
+    # a data envelope, so it is only spendable in a block rather than through the mempool.
+    add_spender(spenders, "tapscript/no10000limit", leaf="t19", standard=False, **SINGLE_SIG, **common)
     # Test that a stack size of 1000 elements is permitted, but 1001 isn't.
     add_spender(spenders, "tapscript/1000stack", leaf="t21", **SINGLE_SIG, **common, failure={"leaf": "t22"}, **ERR_STACK_SIZE)
     # Test that an input stack size of 1000 elements is permitted, but 1001 isn't.
@@ -1061,7 +1063,7 @@ def big_spend_inputs(ctx):
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGVERIFY.
         lambda n, pk: (CScript([OP_DROP, pk, OP_0, OP_IF, OP_2DUP, OP_CHECKSIGVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_2, OP_SWAP, OP_CHECKSIGADD, OP_3, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIG.
-        lambda n, pk: (CScript([random.randbytes(220), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
+        lambda n, pk: (CScript([random.randbytes(75), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGADD.
         lambda n, pk: (CScript([OP_DROP, pk, OP_1, OP_IF, OP_ELSE, OP_2DUP, OP_6, OP_SWAP, OP_CHECKSIGADD, OP_7, OP_EQUALVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_8, OP_SWAP, OP_CHECKSIGADD, OP_9, OP_EQUAL]), n + 1),
         # n+1 OP_CHECKSIGs, but also one OP_CHECKSIG with an empty signature.
diff --git a/test/functional/mempool_datacarrier.py b/test/functional/mempool_datacarrier.py
index 540597199994..9886527355fa 100755
--- a/test/functional/mempool_datacarrier.py
+++ b/test/functional/mempool_datacarrier.py
@@ -3,6 +3,7 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 """Test datacarrier functionality"""
+from test_framework.key import ECKey
 from test_framework.messages import (
     COutPoint,
     CTransaction,
@@ -15,10 +16,15 @@
     CScript,
     OP_1,
     OP_2DROP,
+    OP_7,
+    OP_CHECKMULTISIG,
     OP_DROP,
     OP_RETURN,
+    SIGHASH_ALL,
+    SegwitV0SignatureHash,
     taproot_construct,
 )
+from test_framework.script_util import script_to_p2wsh_script
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.test_node import TestNode
 from test_framework.util import assert_raises_rpc_error
@@ -91,6 +97,122 @@ def test_opnet_transaction(self, node: TestNode, success: bool) -> None:
             assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
                                     self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
+    def test_unproven_pubkeys_transaction(self, node: TestNode, m: int, n: int, success: bool,
+                                          num_inputs: int = 1) -> None:
+        """Spend num_inputs m-of-n P2WSH multisig outputs, offering every signature each asks for.
+
+        The n - m keys left over are ones no signature can prove, and past a small tolerance
+        their bytes are payload rather than a spending condition. The tolerance is per script,
+        so several wide multisig inputs in one transaction do add up.
+        """
+        keys = []
+        for _ in range(n):
+            key = ECKey()
+            key.generate(compressed=True)
+            keys.append(key)
+        # Above 16 a key count is a minimal push rather than an OP_N, which CScript handles.
+        script = CScript([m] + [k.get_pubkey().get_bytes() for k in keys] + [n, OP_CHECKMULTISIG])
+        script_pubkey = script_to_p2wsh_script(script)
+
+        funding_value = 100_000
+        funding = [self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_pubkey,
+                                       amount=funding_value) for _ in range(num_inputs)]
+        self.generate(self.wallet, 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(f['txid'], 16), f['sent_vout'])) for f in funding]
+        spend_tx.vout = [CTxOut(funding_value * num_inputs - 10000, script_pubkey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness() for _ in funding]
+        for i in range(num_inputs):
+            sighash = SegwitV0SignatureHash(script, spend_tx, i, SIGHASH_ALL, funding_value)
+            sigs = [k.sign_ecdsa(sighash) + bytes([SIGHASH_ALL]) for k in keys[:m]]
+            # The leading empty item is the CHECKMULTISIG dummy.
+            spend_tx.wit.vtxinwit[i].scriptWitness.stack = [b''] + sigs + [bytes(script)]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
+
+    def test_odd_key_slots_transaction(self, node: TestNode, slot_size: int, success: bool, n: int = 15) -> None:
+        """Spend a 1-of-n P2WSH whose signing key is last, offering its one signature.
+
+        CHECKMULTISIG tries the last key first, so the n - 1 slots before it are never examined and
+        take a push of any size. Those pushes are data.
+        """
+        key = ECKey()
+        key.generate(compressed=True)
+        script = CScript([1] + [randbytes(slot_size) for _ in range(n - 1)] + [key.get_pubkey().get_bytes(), n, OP_CHECKMULTISIG])
+        script_pubkey = script_to_p2wsh_script(script)
+
+        funding_value = 100_000
+        funding = self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_pubkey, amount=funding_value)
+        self.generate(self.wallet, 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(funding['txid'], 16), funding['sent_vout']))]
+        spend_tx.vout = [CTxOut(funding_value - 10000, script_pubkey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness()]
+        sighash = SegwitV0SignatureHash(script, spend_tx, 0, SIGHASH_ALL, funding_value)
+        sig = key.sign_ecdsa(sighash) + bytes([SIGHASH_ALL])
+        spend_tx.wit.vtxinwit[0].scriptWitness.stack = [b'', sig, bytes(script)]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
+
+    def test_bare_envelope(self, node: TestNode, data_len: int, success: bool, interleave_pushnum: bool = False) -> None:
+        # A bare inscription envelope: <marker> <data>... balanced by OP_2DROP,
+        # with no OP_IF wrapper (the shape ordinals/ord#4545 uses under BIP-110).
+        # A pushnum interleaved in the run (which ord's parser accepts as payload)
+        # must not strand the large push from datacarrier counting.
+        if interleave_pushnum:
+            envelope_script = CScript([randbytes(data_len), OP_7, randbytes(1), OP_2DROP, OP_DROP, OP_1])
+        else:
+            envelope_script = CScript([b'ord', randbytes(data_len), OP_2DROP, OP_1])
+        internal_key = b'\x01' * 32
+        tap = taproot_construct(internal_key, [("leaf", envelope_script), ("dummy", CScript([OP_1]))])
+        leaf = tap.leaves["leaf"]
+        control_block = bytes([leaf.version | tap.negflag]) + tap.internal_pubkey + leaf.merklebranch
+        assert len(control_block) == 65
+
+        utxo = self.wallet.get_utxo()
+        funding_tx = CTransaction()
+        funding_tx.vin = [CTxIn(COutPoint(int(utxo['txid'], 16), utxo['vout']))]
+        funding_value = int(utxo['value'] * 100_000_000) - 1000
+        funding_tx.vout = [CTxOut(funding_value, tap.scriptPubKey)]
+        funding_tx.version = 2
+        self.wallet.sign_tx(funding_tx)
+        funding_tx.rehash()
+        self.nodes[0].sendrawtransaction(funding_tx.serialize().hex())
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(funding_tx.hash, 16), 0))]
+        spend_tx.vout = [CTxOut(funding_value - 1000, tap.scriptPubKey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness()]
+        spend_tx.wit.vtxinwit[0].scriptWitness.stack = [
+            bytes(envelope_script),  # tapscript
+            control_block,           # control block (65 bytes)
+        ]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
     def run_test(self):
         self.wallet = MiniWallet(self.nodes[0])
@@ -141,6 +263,45 @@ def run_test(self):
         self.log.info("Testing an OPNet transaction (just pushing 'op') with -datacarriersize=2.")
         self.test_opnet_transaction(node=self.nodes[3], success=False)
 
+        self.log.info("Testing a bare OP_2DROP envelope larger than the default -datacarriersize.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False)
+
+        self.log.info("Testing a bare OP_2DROP envelope smaller than the default -datacarriersize.")
+        # data_len >= 2 keeps the payload a minimal push; a 1-byte push of 1..16 or 0x81 would be
+        # rejected by MINIMALDATA in script verification rather than accepted by the datacarrier check.
+        self.test_bare_envelope(node=self.nodes[0], data_len=2, success=True)
+
+        self.log.info("Testing a bare envelope with a pushnum interleaved in the push run.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False, interleave_pushnum=True)
+
+        self.log.info("Testing ordinary multisig, which is charged nothing however wide.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=3, n=5, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=6, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=11, n=15, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=14, n=17, success=True)
+        # Several inputs of the same shape, since the budget is per transaction
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=5, success=True, num_inputs=3)
+
+        self.log.info("Testing a multisig padded out with keys no signature can prove.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=11, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=15, success=False)
+
+        self.log.info("Testing that -datacarriersize governs the spare keys, and that multisig "
+                      "with nothing to spare is unaffected by it.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=1, n=12, success=False)
+
+        self.log.info("Testing that what is charged is charged per script, so it adds up over "
+                      "the inputs of a transaction.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=True, num_inputs=2)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=False, num_inputs=3)
+
+        self.log.info("Testing multisig key slots that hold a push of another size, which the spend never examines.")
+        self.test_odd_key_slots_transaction(node=self.nodes[0], slot_size=37, success=False)
+        self.test_odd_key_slots_transaction(node=self.nodes[0], slot_size=100, success=False)
+        self.test_odd_key_slots_transaction(node=self.nodes[0], slot_size=5, success=False, n=20)
+
 
 if __name__ == '__main__':
     DataCarrierTest(__file__).main()