"DEFLATE Compressed Data Format Specification version 1.3"
https://tools.ietf.org/html/rfc1951
Here is the IDAT run switchover point from Vc2eT5I.png >>123:
00004730 00 58 b1 0c d9 46 08 40 b0 87 16 02 10 0c 4f 08 |.X...F.@......O.|
00004740 80 8c 63 b6 0b c0 ff 03 00 00 ff ff bc da 14 2d |..c............-|
00004750 00 00 3f 75 49 44 41 54 ed 9d 77 60 1c d5 d5 f6 |..?uIDAT..w`....|
00004760 67 25 d9 92 9b 24 6c 70 01 8c 83 b1 43 35 60 03 |g%...$lp....C5`.|The deflate bit packing rules are in "3.1.1. Packing into bytes". The deflate block format is in "3.2.3. Details of block format". The first IDAT run ends on hex:[03 00 00 ff ff] before the u32 PNG chunk checksum. The second IDAT run starts with hex:[ed]. As stated in the spec, deflate block boundaries do not naturally line up with byte boundaries, but there is one place that generates alignment:
3.2.4. Non-compressed blocks (BTYPE=00)
Any bits of input up to the next byte boundary are ignored.
The rest of the block consists of the following information:
0 1 2 3 4...
+---+---+---+---+================================+
| LEN | NLEN |... LEN bytes of literal data...|
+---+---+---+---+================================+
LEN is the number of data bytes in the block. NLEN is the
one's complement of LEN.The first IDAT run ends on an empty non-compressed block with LEN=0. The second IDAT run starts with aligned deflate block and byte boundaries, with 0xed=0b11101101 signaling a fixed Huffman code block (BTYPE=01) that is also the last deflate block (BFINAL=1). Therefore, the purpose of the IDAT run divisions and of the iDOT chunk is to provide fixed seek points into the deflate stream, as a limited means of random access. The seek points are on image row boundaries specified in the iDOT chunk >>121. This can be used for things like partial decoding and parallel decoding. Of course, this needs the cooperation of the encoder, both in byte-aligning run leader deflate blocks, such as with an empty non-compressed block, and in not using back references that straddle the seek points. If these conditions are not checked in the decoder then this becomes an attack vector.