If dfdl:lengthKind="explicit" and dfdl:length is an expression that results in a negative value, we end up trying to set a bitLimit less than the current bitPosition, which causes an invariant failed abort. The LengthEv's should never result in a negative value. We need to add a check to the LengthEv's to throw an SDE if the resulting value is ever less than zero.