[aidangarske]

F-4562 - 9d38601 - Bitmask address match scoring now uses bytes and bits consistently.

F-4705 - 836f601 - The bitmask compare padding offset is now computed in bytes instead of bits.

F-8764 - 2dfcdbf - Stale purge now keeps connected routes that are within the max purgeable idle time.

F-13881 - cdc247b - Dispatch now reports resource failures instead of masking them as fallthrough.

F-12514 - 632037d - Copying route metadata now keeps the purge list consistent.

F-8751 - d516ac0 - Dispatch now refreshes the config and route flags after switching to the fallthrough route.

F-13287 - 06466c0 - A disconnect now decrements the connection count regardless of the configured limit.

F-15468 - 0f61445 - A refreshed route is now always repositioned in the purge list.

F-2442 - 7075b98 - Dispatch now sets the error result bit when an action chain fails.

F-2437 - a77765c - Dispatch now warns once when unmatched traffic falls through with an unset default policy.

F-3441 - 45dbe2e - Caller-initialized dispatch input with internal-only result bits is now rejected.

F-6510 - 9eaf7da - A default policy that sets both accept and reject is now rejected.

F-1216 - 738f85f - The default event getter now reports the written label length.

F-10502 - 8b8eebc - A zero count delta is now a no-op, and negative deltas are negated safely.

F-11618 - 2ba552c - Setting a purge time on a route with no parent table is now rejected.

F-2860 - 75d3c17 - Link and CAN address rendering now includes the final partial byte.

F-5564 - 3e9f67c - The route APIs now null check their result and count outputs before writing them.

F-10494 - fbcbeec - Route flag names are now matched by exact length, so parsing never reads past the name.

F-11605 - d4799e6 - A new route is now freed and nulled when taking its parent event reference fails.

F-10493 - 47ac812 - Route clone now reads the address from the source route's address offset.

F-15469 - 30e1b35 - Wildcarding the remote address now compacts the address buffer so the local address stays valid.

F-8766 - 69944c0 - Cloning a route table header now copies the max purgeable idle time.

F-12516 - 94bc172 - The fallthrough route is now referenced before it is published into a cloned table.

F-10489 - 1d577b2 - Copying route metadata now carries the hit count across.

F-3667 - 5ef6343 - A reset default policy is now accepted, and the port reset carries into fallthrough verdicts.

F-2841 - f60740a - A new test covers dispatch rejecting caller-initialized verdict and status bits.

F-2465 - 765b15d - A new test covers the exact stale purge time and idle limit boundaries.

F-2459 - 13d9d8d - A new test covers routes exempt from connection counting never being limited.

F-6258 - d6d6001 - A new test covers connection limit enforcement and slot reuse at a positive limit.

F-5565 - e61719c - A new test covers the most specific of equal-priority overlapping routes winning.

F-2456 - 3c42f53 - A new test covers the exact penalty box duration boundary.

F-2461 - 5f77141 - A new test covers a zero derogatory threshold disabling penalty boxing.

F-2464 - 3c66f92 - A new test covers permanent penalty boxing and boxes with no recorded time.

F-3663 - 7932ad9 - A new test covers the penalty box trigger when commendable events are ignored.

F-13287 - 4a047a2 - Every connection is now counted so disconnects stay balanced when the limit changes, and the limit only decides REJECT.

F-15468 - f5ee3df - A route's purge links are now cleared before it is reinserted into the purge list, which fixes an infinite purge scan.

F-8764 - 19f150f - The per-dispatch stale purge scan on the packet path is now bounded to eight entries.

F-8764 - 8b5812b - The bounded per-dispatch purge now requeues still-connected routes, so it reaches the expired routes behind them.

F-4562 - 7f83766 - Equal-priority bitmask routes are now ranked by the number of bits their mask constrains instead of by address similarity.

F-8764 - 5b36f21 - The purge requeue deadline is now computed through the configured time callbacks.

F-4100 - bbce323 - max_connection_count above the 16-bit per-route counter maximum is now rejected instead of being silently capped.

F-8764 - dc7da59 - Purge idle time for a never-hit route is now measured from its insertion, and a negative idle limit is treated as unlimited.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #104

Scan targets checked: wolfsentry-src, wolfsentry-bugs
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite