btck_transaction_create and btck_block_create ignore any bytes after the serialized object, so the object's serialized length does not match the buffer.
I return null when bytes remain, as for other malformed input, and say so in the header. Two new checks in test_kernel append one byte to a valid transaction and to a valid block. They fail on master and pass with the change. The other kernel tests and the unit tests pass.
This is one of several PRs from a large audit of Bitcoin Core that I did with the help of LLM tools. The audit produced its evidence all at once, which is why the PRs arrive together. I understand each change fully and will answer review questions myself.