[embhorn]

• F-15426: Reset the caller's SN_Object before decoding into it on an ANY wait (committed)
• F-15431: Treat a zero-byte PUBLISH payload read as a network error (committed)
• F-13804: Map zero and terminal TLS read/write results to network errors; hardening, since the hang didn't reproduce with wolfSSL 5.9.2 (committed)
• F-13802: Drop a queued PUBLISH that doesn't fit the subscriber's TX buffer (committed)
• F-15373: Reset the wait state when the automatic ack fails to encode (committed)
• F-11485: Ignore a PUBACK for an outbound QoS 2 delivery (committed)
• F-11478: Publish the Will when a v5 DISCONNECT fails to decode (committed)
• F-13236: Send a Protocol Error DISCONNECT on a Session Expiry change from 0 to non-zero (committed)
• F-11489: Advertise Shared Subscriptions as unavailable and refuse them with SUBACK 0x9E (committed)
• F-12448: Bound v5 ack, DISCONNECT and AUTH decoding to the Remaining Length (committed)
• F-11484: Don't acknowledge a PUBLISH whose fan-out couldn't be queued (committed)
• F-13225: Refuse a CONNECT when its Will can't be stored in full (committed)
• F-14194: Refuse a QoS 1/2 publish with no replay slot on a persistent session (committed)
• F-12447: Reject MQTT-SN ClientIds longer than 23 characters (committed)
• F-11479: Report listener accept failures, without letting a peer stop the broker (committed)
• F-13227: Report namespace directory fsync failures (committed)
• F-11483: Report I/O failures from the POSIX iterator (committed)
• F-11481: Propagate sync hook failures from the commit helpers (committed)
• F-11480: Report failures from the non-static BrokerPersist_DelOutQueue (committed)
• F-12446: Write META only after a complete schema-mismatch wipe (committed)
• F-11482: Fail restore on allocation failure (committed)
• F-11492: Bind encrypted records to their namespace and storage key (committed)
• F-13261: Scrub rx_buf when cancelling an active receive (committed)
• F-12509: Scrub client buffers when abandoning the network connection (committed)
• F-12465: Correct the Receive Maximum quota-release comment (committed)
• F-12470: Document the sleep DISCONNECT wait in SN_Client_Disconnect_ex (committed)
• F-12471: Update the CONNECT Session Present comment (committed)
• F-13231: Correct the persistence hook key length contract (staged, awaiting your commit)

[Copilot]

🟡 Changes recommended

Unresolved build-configuration and broker recovery issues can prevent builds, lose deliveries, or evict valid sessions.

4 open findings

• QoS 2 fan-out loss after incomplete delivery · New
• Persistence callbacks reference retained-only helper · New
• Failed Will allocation orphans new clean-start Session · New
• Accepts CONNECT when Shared Subscription property allocation fails · New

What changed in this PR

This PR hardens wolfMQTT’s client, embedded broker, and persistence layer against protocol errors, resource exhaustion, and transport failures.

Changes:

• Tightens packet decoding, session replay, broker acknowledgements, and connection handling.
• Improves persistence error propagation, encrypted-record binding, and buffer scrubbing.
• Adds regression tests and clarifies API documentation.

File	Description
wolfmqtt/​mqtt_sn_client.h	Documents disconnect acknowledgement waits.
wolfmqtt/​mqtt_client.h	Adds persistent-session flag and replay documentation.
wolfmqtt/​mqtt_broker.h	Clarifies accept and persistence-key contracts.
tests/​test_mqtt_tls_host.c	Tests TLS peer closure handling.
tests/​test_mqtt_sn.c	Tests ClientId length limits.
tests/​test_mqtt_sn_client.c	Tests reused receive-object safety.
tests/​test_mqtt_packet.c	Tests packet-boundary enforcement.
tests/​test_mqtt_client.c	Tests replay limits, cleanup, and receive failures.
tests/​test_broker_connect.c	Adds broker and persistence regressions.
tests/​test_broker_alloc.h	Enables fsync failure injection.
src/​mqtt_socket.c	Handles terminal TLS results.
src/​mqtt_sn_packet.c	Rejects oversized ClientIds.
src/​mqtt_sn_client.c	Resets caller-owned receive objects.
src/​mqtt_packet.c	Bounds decoding to Remaining Length.
src/​mqtt_client.c	Enforces replay capacity and improves cleanup.
src/​mqtt_broker.c	Hardens delivery and connection handling.
src/​mqtt_broker_persist.c	Propagates failures and authenticates record locations.
src/​mqtt_broker_persist_posix.c	Reports durability and iteration failures.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved delivery-loss, buffer-scrubbing concurrency, and client-state issues block approval.

4 open findings

• Propagate offline subscriber enqueue allocation failures · New
• Coordinate active I/O before clearing packet buffers · New
• Honor CONNACK Session Expiry in replay-capacity guard · New
• Preserve caller context when resetting PUBLISH · New

4 resolved since last review

• Persistence callbacks reference retained-only helper
• QoS 2 fan-out loss after incomplete delivery
• Accepts CONNECT when Shared Subscription property allocation fails
• Failed Will allocation orphans new clean-start Session

🧠 Review effort: Balanced

[aidangarske]

Skoll Multi-Scan Review

Modes: review + review-security

Overall recommendation: REQUEST_CHANGES
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] [review] Late CONNECT refusal tears down the incumbent session — src/mqtt_broker.c:7141-7163
• [High] [review] Oversized queued QoS delivery is dropped but acknowledged — src/mqtt_broker.c:2113-2158
• [High] [review] Protocol-error DISCONNECT is lost on deferred writes — src/mqtt_broker.c:8985-8988
• [Medium] [review-security] Default accept adapters suppress resource and setup failures — src/mqtt_broker.c:591-600,747-761

Review generated by Skoll

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.