Problem

In BufferedStream.WriteToUnderlyingStreamAsync, there's a potential integer overflow when calculating whether to use the buffer. This occurs when writing very large buffers (close to or exceeding ~1GB).

The issue is at line 1081 in src/libraries/System.Private.CoreLib/src/System/IO/BufferedStream.cs:

checked
{
    // We do not expect buffer sizes big enough for an overflow, but if it happens, lets fail early:
    totalUserBytes = _writePos + buffer.Length;
    useBuffer = (totalUserBytes + buffer.Length < (_bufferSize + _bufferSize));
}

When buffer.Length is very large, the expression totalUserBytes + buffer.Length can overflow because it's using signed int arithmetic, causing an OverflowException to be thrown.

Root Cause

The synchronous Write methods have already been fixed to use (uint) casting to prevent overflow:

// Line 871 in Write(byte[], int, int):
useBuffer = ((uint)totalUserbytes + count < (_bufferSize + _bufferSize));

// Line 942 in Write(ReadOnlySpan<byte>):
useBuffer = ((uint)totalUserbytes + buffer.Length < (_bufferSize + _bufferSize));

However, the async version in WriteToUnderlyingStreamAsync is missing this cast.

Fix

Change line 1081 from:

useBuffer = (totalUserBytes + buffer.Length < (_bufferSize + _bufferSize));

To:

useBuffer = ((uint)totalUserBytes + buffer.Length < (_bufferSize + _bufferSize));

This matches the fix already applied to the synchronous Write methods and prevents the overflow by promoting the arithmetic to unsigned.

Related Issue

This fix addresses the OverflowException described in #117789, which occurs when MemoryStream.CopyToAsync writes large buffers to a BufferedStream.