Schnorr protocol: how does malicious verifier win? My question is about the challenge space size in Schnorr protocol. To be precise, I feel I've read all the Internet (twice) and I still don't understand why is it bad to allow challenge space to be large (say, why one shouldn't let $\text{Challenge} \in \mathbb{Z}_q$)

I'm interested only in situation of honest prover $P$ and malicious verifier $\tilde{V}$.

To settle the notation, recall that (one round of) Schnorr protocol has the following form:


Prover generates random $r \in \mathbb{Z}_q$, calculates $\text{Commit}=g^r \pmod p$, then sends $\text{Commit}$ to verifier.
Verifier generates $m$ random bits and forms the number $\text{Challenge}$ from them (thus $\text{Challenge}$ is the random number ranging from $0$ to $2^{m} - 1$), then sends $\text{Challenge}$ to prover.
Prover calculates $\text{Response} = r+s \cdot \text{Challenge} \pmod q$, then sends $\text{Response}$ to verifier.
Verifier checks that $g^{\text{Response}} = \text{Commit} \cdot y^{\text{Challenge}} \pmod p$


where $y = g^s \pmod p$ and $s$ is the prover's secret.

The simulator for this protocol is as follows. 


The algorithm generates random $\text{Response} \in \mathbb{Z}_p$.
The algorithm asks verifier for the number $\text{Challenge}$ and receives it.
The algorithm sets $\text{Commit} = g^{\text{Response}} \cdot y^{-\text{Challenge}} \pmod p$
The algorithm appends $(\text{Commit}, \text{Challenge}, \text{Response})$ to the transcript.


The standard answer to my question is: if $\text{Challenge}$ is pseudorandom -- namely, depends on $\text{Commit}$, say, is equal to $\text{hash} (\text{Commit} || M)$ -- this simulator protocol cannot work, since at step 2 it requires the knowledge of parameter generated at step 3. There are no other simulators known for this protocol, so in the case of malicious verifier there's just no simulator. And since any ZK-protocol has simulator, the conclusion follows that malicious verifier case is not ZK. 

Question 1. However, I still don't get how exactly can malicious verifier extract some information. Okay, there's no known simulator for malicious verifier case -- well, how does it help him?

Question 2. What about the challenge space size? Mao, Wenbo in their "Modern Cryptography" state that, thus, because of this simulator argument, $\text{Challenge}$ space size should NOT be large (don't get the logic again) ($\text{Challenge} \in \mathbb{Z}_q$ is prohibited)  and state that the best choice is $\text{Challenge} \in [0, \log_2 p)$ (or, equivalently, $m = \log_2 \log_2 p$). Why such an odd and strange value?
This all seems to be explained in the book (warning: large) you mention, all I mention here is taken from there. 

This is the last sentence before $\S18.3.2$:


  Enlarging challenge size not only improves performance (a positive result), in $\S18.3.2$ we will further see that this also has a negative consequence. Be careful, size matters!


This last sentence is of critical importance, but we will focus on the first one for now. Moving to $\S18.3.2$, we find the last sentence before $\S18.3.2.1$:


  However, there is a subtlety for the problem. Let us examine it now.


This is followed by about 2 pages of explanation to your question, which indeed they agree to have subtleties. Although you have read all the internet twice (kudos), your answer suggests you may have missed this.

It seems that setting 


  $${\tt Challenge}={\tt prf}(M||{\tt Commit})={\tt prf}(M||g^{\tt Response}y^{\tt
&gt; Challenge}\bmod{p})$$


leads to two options:


  
  The equation was constructed by Alice using her private input, and hence Alice discloses the fact that she has been in interaction with,
  and fooled by, $\tilde{Bob}$, or
  $\tilde{Bob}$ has successfully broken the pseudo-random function ${\tt prf}$ of the large output space $\mathbb{Z}_q$, because he has
  constructed equation $${\tt Challenge}={\tt prf}(\cdots y^{\tt Challenge}).$$ This is a well-known hard problem because ${\tt prf}$
  is assumed to be one-way.
  
  
  Given that $\tilde{Bob}$ is assumed to be polynomially bounded, the
  third party will of course believe that (i) is the case.


The information revealed is thus the fact that the prover has been interacting with the malicious verifier. Luckily, the authors mention that


  A small consolidation for Alice is that the information disclosure caused by $\tilde{Bob}$ is not a too disastrous one (though this assertion has to be based on applications really). [...] the proof transcript still does not disclose to $\tilde{Bob}$ or a third party any information about Alice's private input $a$.