Networking-audit deferred plan §6:
- 6.1 client reassembler ceiling derived from the negotiated rate:
Welcome::session_config (client role) now sets max_frame_bytes to
clamp(4 × bitrate_kbps×125 / refresh_hz, 8 MiB, 64 MiB) instead of the
blanket 64 MiB p1_defaults bound — the hostile-header memory ceiling was
~10× larger than any real access unit. Local only (the host never
reassembles video; the wire is self-describing); a bitrate-0 (older)
host keeps the old bound. Unit-tested floor/derived/host/old-host cases.
- 6.2 ProbeState.active is cleared when the host's ProbeResult lands, so
the pump stops mirroring receive counters once the burst is over.
- 6.3 Android: an AU larger than the codec input buffer is DROPPED with a
recovery-keyframe request and a counter, on both the sync (feed) and
async (feed_ready) paths — a truncated AU is corrupt input the decoder
chews on silently, poisoning the reference chain until the next IDR. The
async path recycles the never-queued input slot; the sync path returns
the dequeued slot with zero valid bytes.
- 6.4 bounded uplink channels: mic_tx at 64 (~320 ms of 5 ms frames;
overflow sheds the fresh frame with a debug log — a tokio mpsc can't
shed from the head, and past 320 ms of backlog the mic is broken either
way; the bound is about memory) and ctrl_tx at 32 (sparse requests; a
full queue means a wedged control task, reported as Closed). input_tx
stays unbounded per the plan: keyboard/mouse events must never silently
drop, and gamepad state is snapshot-healed.
- 6.5 (wire version byte says P1 while streaming Gf16): record-only,
resolves with the P2 packet revision.
include/punktfunk_core.h: cbindgen re-emitted in the new module order
after the quic/ split (item 3) — no semantic change beyond the reorder.
cargo ndk check (arm64-v8a), workspace clippy, core+host tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
enricobuehler
ddb93c533c