More various fixes (F-*)#107

Open

gasbytes wants to merge 10 commits intowolfSSL:masterfrom

gasbytes:2026-04-26-findings-fixes

Commits on Apr 30, 2026

add a tcp_time_wait branch in tcp_input that re-sends an ack on any
gasbytes
committed
Gate request-side arp_store_neighbor in arp_recv on a matching arp_pending_match_and_clear so unsolicited ARP requests can no longer fill the neighbor cache and lock out legitimate replies, with te…
gasbytes
committed
Add test_syn_sent_rst_ack_seg_ack_bounds to pin RFC 9293 section 3.10.7.3
gasbytes
committed
Reject buffers shorter than ETH_HEADER_LEN at the top of wolfIP_recv_on's
gasbytes
committed
add test_multicast_igmp_query_bad_checksum_dropped to pin the IGMP checksum
gasbytes
committed
Add a udp.len <= ip.len - IP_HEADER_LEN guard in udp_try_recv so an L2-padded
gasbytes
committed
Replace the signed-int (... & 0xFF) << 24 reassembly in dns_callback's A-record
gasbytes
committed
Add a martian + strict-RPF source filter to ip_recv's WOLFIP_ENABLE_FORWARDING
gasbytes
committed
Add an if (!s) return -WOLFIP_EINVAL; guard to wolfIP_sock_socket so a NULL
gasbytes
committed
move WOLFIP_LOOPBACK_IP/WOLFIP_LOOPBACK_MASK outside of the loopback gate, since the forwarding rpf code uses them uncoditionally now
gasbytes
committed