Patrick Steinhardt [off-list ref] writes:
Yes we do, because there is an early return in case `verify_bundle()`
fails. I didn't notice that we have it in `unbundle()` though.
Ah, I missed that one.
I'd argue it's bad practice to have `unbundle()` clear the caller
provided args for us and somewhat surprising.
I was surprised so it makes it at least two of us. In some call
patterns, having the callee _consume_ what the caller fed it may
be natural, but not in this code path.
Thanks.