RawImage.init(..., 16) panics because a u16 shift cannot represent a shift count of 16. Other bit depths also reported 2^bits as the white level instead of the maximum sample value. Empty dimensions and invalid bit depths reached allocation unchecked.
Validate geometry/depth before allocation, calculate white levels in u32 (2^bits - 1), and widen pixel-count/index arithmetic to usize. Add tests for 12/16-bit white levels, invalid input, and allocation failure.
Validation: reproduced the original 16-bit panic; focused RAW tests pass in Debug and ReleaseSafe with the Home Zig toolchain. Zig formatting and targeted Pickier completed. No whole-compiler-suite claim.