@@ -1,7 +1,6 @@
 package commands
 
 import (
-	"bytes"
 	"io"
 	"os"
 	"path/filepath"
@@ -84,11 +83,9 @@ func isAutoTrackExcluded(fileName string) bool {
 func clean(gf *lfs.GitFilter, to io.Writer, from io.Reader, fileName string, fileSize int64) (*lfs.Pointer, error) {
 	// Git-critical files must never become LFS pointers
 	if gitCriticalExcluded(fileName) {
-		content, err := io.ReadAll(from)
-		if err != nil {
+		if _, err := tools.Spool(to, from, cfg.TempDir()); err != nil {
 			return nil, err
 		}
-		to.Write(content)
 		return nil, nil
 	}
 
@@ -113,18 +110,54 @@ func clean(gf *lfs.GitFilter, to io.Writer, from io.Reader, fileName string, fil
 	}
 
 	autoTrackSize, _ := gitattr.GetAutoTrackSize(cfg.LocalWorkingDir(), fileName)
-	if autoTrackSize > 0 && fileSize >= 0 && (isAutoTrackExcluded(fileName) || fileSize < autoTrackSize) {
-		content, err := io.ReadAll(from)
+
+	if autoTrackSize > 0 {
+		tmpfile, err := os.CreateTemp(cfg.TempDir(), "")
+		if err != nil {
+			return nil, err
+		}
+		defer func() {
+			tmpfile.Close()
+			os.Remove(tmpfile.Name())
+		}()
+
+		n, err := io.Copy(tmpfile, from)
 		if err != nil {
 			return nil, err
 		}
 
-		if ptr, decodeErr := lfs.DecodePointer(bytes.NewReader(content)); decodeErr == nil && ptr != nil {
-			to.Write(content)
+		if _, err := tmpfile.Seek(0, io.SeekStart); err != nil {
+			return nil, err
+		}
+
+		// Check if content is already a pointer (already tracked in LFS)
+		if ptr, decodeErr := lfs.DecodePointer(tmpfile); decodeErr == nil && ptr != nil {
+			if _, err := tmpfile.Seek(0, io.SeekStart); err != nil {
+				return nil, err
+			}
+			if _, err := io.Copy(to, tmpfile); err != nil {
+				return nil, err
+			}
 			return ptr, nil
 		}
-		to.Write(content)
-		return nil, nil
+
+		// Pass through if excluded or under the autotrack threshold
+		if isAutoTrackExcluded(fileName) || n < autoTrackSize {
+			if _, err := tmpfile.Seek(0, io.SeekStart); err != nil {
+				return nil, err
+			}
+			if _, err := io.Copy(to, tmpfile); err != nil {
+				return nil, err
+			}
+			return nil, nil
+		}
+
+		// File exceeds threshold, re-read from temp file for gf.Clean
+		if _, err := tmpfile.Seek(0, io.SeekStart); err != nil {
+			return nil, err
+		}
+		from = tmpfile
+		fileSize = n
 	}
 
 	cleaned, err := gf.Clean(from, fileName, fileSize, cb)
 
@@ -1,9 +1,14 @@
 package commands
 
 import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/git-lfs/git-lfs/v3/config"
+	"github.com/git-lfs/git-lfs/v3/lfs"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -184,3 +189,135 @@ func TestIsAutoTrackExcludedUserConfigEmpty(t *testing.T) {
 	assert.True(t, isAutoTrackExcluded(".gitlab-ci.yml"))
 	assert.False(t, isAutoTrackExcluded("normal.dat"))
 }
+
+// setupAutoTrackTest creates a temporary directory with a .gitattributes file
+// and a .git/lfs/tmp directory (needed by cfg.TempDir()), then replaces the
+// global cfg with a config pointing to that directory. The returned function
+// restores the original cfg.
+func setupAutoTrackTest(t *testing.T, gitattributesContent string) func() {
+	t.Helper()
+	dir := t.TempDir()
+
+	err := os.MkdirAll(filepath.Join(dir, ".git", "lfs", "tmp"), 0755)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if gitattributesContent != "" {
+		err = os.WriteFile(filepath.Join(dir, ".gitattributes"), []byte(gitattributesContent), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	saved := cfg
+	cfg = config.NewIn(dir, "")
+	return func() { cfg = saved }
+}
+
+// --- Plan point 6: Memory concern with io.ReadAll — spooling in clean() ---
+
+func TestCleanAutoTrackPassThrough(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=100")()
+
+	gf := lfs.NewGitFilter(cfg)
+	var buf bytes.Buffer
+	data := strings.NewReader("small file content")
+
+	ptr, err := clean(gf, &buf, data, "test.dat", -1)
+	assert.Nil(t, ptr)
+	assert.NoError(t, err)
+	assert.Equal(t, "small file content", buf.String())
+}
+
+func TestCleanAutoTrackGitCriticalExcluded(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=10")()
+
+	gf := lfs.NewGitFilter(cfg)
+	var buf bytes.Buffer
+	data := strings.NewReader("this is a much longer file content that exceeds")
+
+	ptr, err := clean(gf, &buf, data, ".gitattributes", -1)
+	assert.Nil(t, ptr)
+	assert.NoError(t, err)
+	assert.Equal(t, "this is a much longer file content that exceeds", buf.String())
+}
+
+func TestCleanAutoTrackExcludedFile(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=10")()
+
+	gf := lfs.NewGitFilter(cfg)
+	var buf bytes.Buffer
+	data := strings.NewReader("this is a much longer file content that exceeds")
+
+	ptr, err := clean(gf, &buf, data, "readme.md", -1)
+	assert.Nil(t, ptr)
+	assert.NoError(t, err)
+	assert.Equal(t, "this is a much longer file content that exceeds", buf.String())
+}
+
+func TestCleanAutoTrackAlreadyPointer(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=100")()
+
+	gf := lfs.NewGitFilter(cfg)
+	var buf bytes.Buffer
+	pointerContent := "version https://git-lfs.github.com/spec/v1\noid sha256:7cd8be1d2cd0dd22cd9d229bb6b5785009a05e8b39d405615d882caac56562b5\nsize 1024\n"
+	data := strings.NewReader(pointerContent)
+
+	ptr, err := clean(gf, &buf, data, "test.dat", -1)
+	assert.NotNil(t, ptr)
+	assert.NoError(t, err)
+	assert.Equal(t, pointerContent, buf.String())
+}
+
+// --- Plan point 7: Smudge pass-through check ---
+
+func TestSmudgePassThroughAutoTrack(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=100")()
+
+	// File under threshold passes through
+	assert.True(t, smudgePassThrough("test.dat", 50))
+
+	// File over threshold does not pass through
+	assert.False(t, smudgePassThrough("test.dat", 200))
+
+	// Excluded file passes through regardless of size
+	assert.True(t, smudgePassThrough("readme.md", 200))
+
+	// Git-critical file passes through regardless of size
+	assert.True(t, smudgePassThrough(".gitattributes", 200))
+}
+
+// --- Plan point 8: fileSize = -1 (PR #6011 scenario) ---
+
+func TestCleanAutoTrackFileSizeNegativeOne(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=100")()
+
+	gf := lfs.NewGitFilter(cfg)
+	var buf bytes.Buffer
+	data := strings.NewReader("small content")
+
+	// fileSize=-1 simulates behavior after PR #6011; the autotrack
+	// pass-through must not depend on this parameter.
+	ptr, err := clean(gf, &buf, data, "test.dat", -1)
+	assert.Nil(t, ptr)
+	assert.NoError(t, err)
+	assert.Equal(t, "small content", buf.String())
+}
+
+func TestCleanAutoTrackFileSizeNegativeOneOverThreshold(t *testing.T) {
+	defer setupAutoTrackTest(t, "* autotracksize=10")()
+
+	gf := lfs.NewGitFilter(cfg)
+	var buf bytes.Buffer
+	data := strings.NewReader("this is a much longer file content that exceeds")
+
+	ptr, err := clean(gf, &buf, data, "nontracked.dat", -1)
+	// With autotrack active, file over threshold should NOT pass through
+	// as (nil, nil). It hits gf.Clean which needs a real git repo, so
+	// we expect some error (ExitWithError or similar), but the key is
+	// that it did NOT silently pass through via the old fileSize >= 0 gating.
+	if ptr == nil && err == nil {
+		t.Errorf("file over threshold with autotrack should not return (nil, nil); must reach gf.Clean")
+	}
+}