nixos/malloc: warn about old Scudo options

NixOS 25.11 uses standalone Scudo for the first
time (85b124c). With this change, options are now
snake_case instead of CamelCase.

https://llvm.org/docs/ScudoHardenedAllocator.html#options

There is currently no breaking-change warning or
evaluation warning to alert users of this change.
As a consequence, users may run into scudo's runtime
warnings. This adds a straightforward evaluation-time
warning if an old-style option is detected.

nixos/modules/config/malloc.nix

@@ -122,6 +122,31 @@ in
   };
 
   config = lib.mkIf (cfg.provider != "libc") {
+    # Legacy (LLVM < 13) Scudo uses CamelCase options.
+    # Standalone (LLVM >= 13) Scudo uses snake_case options.
+    # NixOS switched in 25.11: https://github.com/NixOS/nixpkgs/pull/444605
+    warnings =
+      let
+        scudoOpts = config.environment.variables.SCUDO_OPTIONS;
+
+        legacyOptionNames = [
+          "QuarantineSizeKb"
+          "QuarantineChunksUpToSize"
+          "ThreadLocalQuarantineSizeKb"
+          "DeallocationTypeMismatch"
+          "DeleteSizeMismatch"
+          "ZeroContents"
+        ];
+
+        # Check which legacy options are in SCUDO_OPTIONS,
+        # so we can warn the user about the change.
+        legacyOptionsUsed = lib.lists.filter (opt: lib.strings.hasInfix opt scudoOpts) legacyOptionNames;
+      in
+      lib.optional (cfg.provider == "scudo" && legacyOptionsUsed != [ ]) ''
+        environment.variables.SCUDO_OPTIONS: ${lib.concatStringsSep ", " legacyOptionsUsed} is/are no longer valid Scudo options.
+        Use snake_case instead of CamelCase: https://llvm.org/docs/ScudoHardenedAllocator.html#options
+      '';
+
     environment.etc."ld-nix.so.preload".text = ''
       ${providerLibPath}
     '';