a bit untested, I am sure all standalone modes fails now. lets see if this is enough of bounds checking

CHANGELOG.md

@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Fixed ISO14443a bounds-checking because @doegex found cards not following ISO14443a when fuzzed (@iceman1001)
 - Added `mfkey32nested`: recovering partial nested authentication with known nT (@doegox)
 - Added support for dumping FM11RF08S data at once (@doegox)
 - Added support for collecting all FM11RF08S nT/{nT}/par_err at once (@doegox)

armsrc/iso14443a.c

@@ -483,6 +483,11 @@ void Demod14aInit(uint8_t *d, uint16_t n, uint8_t *par) {
 
 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
 RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time) {
+
+    if (Demod.len == Demod.output_len - 1) {
+        return true;
+    }
+
     Demod.twoBits = (Demod.twoBits << 8) | bit;
 
     if (Demod.state == DEMOD_14A_UNSYNCD) {