Severity: minor (blocks re-enabling the LAK package on wider extents)
Where: src/nhflodata/data/mockup/lakes_pwn/.../lakes_pwn.geojson — lake 'Vlotter 0' has lakeout='-1' stored as a string (and the bassin strt is NaN).
Problem. nlmod.gwf.lake.lake_from_gdf treats any string lakeout as a boundname to resolve; no lake is named '-1', so the boundname mask is empty and gdf.loc[mask, "lakeno"].iloc[0] raises IndexError instead of creating an out-of-model outlet (which requires integer -1, flopy zero-based). Inert today only because the Vlotter lakes fall outside the Bergen extent; any wider extent that re-enables the LAK block crashes here.
Suggested fix. Store lakeout as integer -1 (or empty) in the geojson. A complementary nlmod hardening issue (parse numeric strings / raise a clear error) is filed upstream. Relates to #9 (validate geojson) and #11 (merge lakes).
From a systematic review of modelscripts/09pwnmodel2/01_pwnmodel2.py and its dependency stack (nhflotools, nhflodata, nlmod), July 2026. Every finding was traced through the actual code and adversarially verified before filing.
Severity: minor (blocks re-enabling the LAK package on wider extents)
Where:
src/nhflodata/data/mockup/lakes_pwn/.../lakes_pwn.geojson— lake 'Vlotter 0' haslakeout='-1'stored as a string (and thebassinstrtis NaN).Problem.
nlmod.gwf.lake.lake_from_gdftreats any stringlakeoutas a boundname to resolve; no lake is named'-1', so the boundname mask is empty andgdf.loc[mask, "lakeno"].iloc[0]raisesIndexErrorinstead of creating an out-of-model outlet (which requires integer-1, flopy zero-based). Inert today only because the Vlotter lakes fall outside the Bergen extent; any wider extent that re-enables the LAK block crashes here.Suggested fix. Store
lakeoutas integer-1(or empty) in the geojson. A complementary nlmod hardening issue (parse numeric strings / raise a clear error) is filed upstream. Relates to #9 (validate geojson) and #11 (merge lakes).From a systematic review of
modelscripts/09pwnmodel2/01_pwnmodel2.pyand its dependency stack (nhflotools, nhflodata, nlmod), July 2026. Every finding was traced through the actual code and adversarially verified before filing.