DRA: ResourceSlice validation panics on a zero with an extreme negative exponent in capacity.requestPolicy.validValues

What happened?

With DRAFractionalCapacityRange enabled (beta, on by default since 1.37), validating a ResourceSlice whose device capacity has requestPolicy.validValues containing 0e-2147483647 panics inside ValidateResourceSlice:

runtime error: makeslice: cap out of range

ParseQuantity("0e-2147483647") is accepted (a zero on the inf.Dec backend with scale 2147483647), and validateRequestPolicyValidValues keys the values with quantityKeyAsDec, which calls AsDec().String(); inf.Dec.String allocates scale+2 bytes for a value below one (gopkg.in/inf.v0/dec.go:442) and overflows.

Reproduced on master (6c1c7702 and later) with a unit probe in pkg/apis/resource/validation:

featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.DRAFractionalCapacityRange, true)
bad := apiresource.MustParse("0e-2147483647")
cap := testDeviceCapacity(apiresource.MustParse("1"), testCapacityRequestPolicy(ptr.To(apiresource.MustParse("1")), []apiresource.Quantity{bad, apiresource.MustParse("1")}, nil))
slice := testResourceSlice("slice", "node", "driver.example.com", 1)
slice.Spec.Devices[0].AllowMultipleAllocations = ptr.To(true)
slice.Spec.Devices[0].Capacity["memory"] = cap
ValidateResourceSlice(slice) // panics

validateMultiAllocatableDeviceCapacity PANIC: runtime error: makeslice: cap out of range
ValidateResourceSlice PANIC: runtime error: makeslice: cap out of range

In the apiserver the panic is recovered by the handler, so the request fails with a 500 instead of a validation error. release-1.37 has the same quantityKeyAsDec key function (validation.go:1420,1755) with the gate on by default, and ParseQuantity accepts the input there too, so v1.37 is affected as well.

What did you expect to happen?

A validation error, or acceptance of the value as zero; no panic.

How can we reproduce it (as minimally and precisely as possible)?

The probe above, or a ResourceSlice with spec.devices[].capacity.<name>.requestPolicy.validValues: ["0e-2147483647"] and allowMultipleAllocations: true against a cluster with the gate enabled.

Anything else we need to know?

#142355 removes quantityKeyAsDec and keys every value through quantityKeyInt, which does not call AsDec().String(), so it fixes this as a side effect; a regression row for 0e-2147483647 in validation_device_capacity_test.go would pin it. Related: #141166 (Quantity int64/int32 tracker); the parser accepting a zero with an out-of-range exponent is #142452.

Kubernetes version

master 6c1c7702 (2026-09-27); the gate is beta and on since v1.37.

/kind bug /sig node