CreateTransaction checks that recipient amounts aren't negative, but not that they're within MAX_MONEY. CreateTransactionInternal then sums them into recipients_sum (spend.cpp:1100) with no range check, and that sum can overflow.
Easiest way to hit it is fundrawtransaction with a raw tx that has two outputs of 2^62 sat. It can also be reached with only valid amounts through walletcreatefundedpsbt/send/sendmany and a few thousand 21M BTC outputs. The "Transaction too large" check only runs after coin selection, so it doesn't stop this. On master the node aborts:
Assertion failed: (!m_selected_inputs.empty()), function RecalculateWaste, file coinselection.cpp, line 904.
UBSan reports the overflow at spend.cpp:1100 first. With other values the sum wraps to a small positive number instead, and fundrawtransaction returns success for a tx with outputs of 46116860184 BTC each.
This checks every amount and the running sum against MoneyRange in the existing recipients loop of CreateTransactionInternal, before the amount is added to recipients_sum, and returns "Transaction output amount must be valid" before coin selection starts. The same check rejects negative amounts, so the separate negative check in CreateTransaction is removed. The new test_outputs_above_max_money in wallet_fundrawtransaction.py covers a single output above MAX_MONEY, two outputs whose sum is above it, a sum that overflows int64, and a negative output. On master the first case returns "Insufficient funds" and the overflow case crashes the node; with the fix all of them get the new error. wallet_fundrawtransaction.py, wallet_send.py, wallet_basic.py and rpc_psbt.py pass.
