diff --git a/crates/auto_update_helper/src/dialog.rs b/crates/auto_update_helper/src/dialog.rs
index 1d8c4f8a4b6..81ef1c588d1 100644
--- a/crates/auto_update_helper/src/dialog.rs
+++ b/crates/auto_update_helper/src/dialog.rs
@@ -214,7 +214,10 @@ unsafe extern "system" fn wnd_proc(
         }
         WM_NCDESTROY => unsafe {
             // The window is going away and no further messages will reference the state, so
-            // reclaim and drop the boxed `DialogInfo` exactly once.
+            // reclaim and drop the boxed `DialogInfo` here. This frees it at most once, and only
+            // if `WM_NCDESTROY` actually runs: the normal exit path uses `PostQuitMessage` (which
+            // unwinds the message loop without destroying the window) and simply leaks the box to
+            // process exit, as before.
             let raw = GetWindowLongPtrW(hwnd, GWLP_USERDATA) as *mut RefCell<DialogInfo>;
             if !raw.is_null() {
                 SetWindowLongPtrW(hwnd, GWLP_USERDATA, 0);
diff --git a/crates/gpui_windows/src/events.rs b/crates/gpui_windows/src/events.rs
index df24d2619b2..e381fdedd40 100644
--- a/crates/gpui_windows/src/events.rs
+++ b/crates/gpui_windows/src/events.rs
@@ -1153,9 +1153,13 @@ impl WindowsWindowInner {
         const MAX_UNITS: usize = 64;
         let mut units = Vec::with_capacity(MAX_UNITS);
         for offset in 0..MAX_UNITS {
-            // SAFETY: `pointer` is non-null and we advance one unit at a time only while the
-            // preceding unit was a non-NUL part of the string, stopping at the terminator, so we
-            // never read past the end of a well-formed NUL-terminated buffer.
+            // SAFETY: `pointer` is non-null. For a well-formed NUL-terminated buffer we stop at
+            // the terminator and never read past the end. For a malformed, non-NUL-terminated
+            // buffer (e.g. a hostile message) `pointer.add(offset)` can still walk past the real
+            // allocation, so this is technically an over-read; the `MAX_UNITS` cap only *mitigates*
+            // that rather than eliminating it. It is nonetheless a strict improvement over the
+            // prior unbounded scan, and the cap cannot cause us to miss the only value we compare
+            // against ("ImmersiveColorSet", 17 units), which fits well within the limit.
             let unit = unsafe { pointer.add(offset).read() };
             if unit == 0 {
                 break;