Fenrir fixes

[mattia-moffa]

Description

Fixes F-10044, F-10725, F-10726

• F-10044: MAX3266X-specific reliability bug
• F-10725, F-10726: protocol compliance bug

[Copilot]

Pull request overview

Fixes Fenrir issues related to QUIC + TLS 1.3 post-handshake authentication behavior and improves robustness of the MAX3266x MAA hardware math path.

Changes:

• Initialize the temporary mp_int result struct in the MAX3266x MAA hardware math helper when the output aliases an input.
• Disallow TLS 1.3 post-handshake authentication APIs when the WOLFSSL* is configured for QUIC, and reject QUIC post-handshake CertificateRequest messages.
• Add a QUIC regression check asserting post-handshake auth APIs fail under QUIC (per RFC 9001 §4.4).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
wolfcrypt/src/port/maxim/max3266x.c	Zero-initializes a temporary mp_int used as a non-aliased hardware result buffer.
tests/quic.c	Adds test coverage ensuring post-handshake auth APIs are rejected for QUIC connections.
src/tls13.c	Enforces “no post-handshake auth over QUIC” in both message handling and public APIs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +192 B (+0.2%, 204,701 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +192 B (+0.2%, 178,328 B / 262,144 B, total: 68% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +192 B (+0.1%, 186,428 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +176 B, .text +192 B (+0.0%, 780,652 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +128 B (+0.1%, 217,564 B / 262,144 B, total: 83% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +168 B, .text +192 B (+0.1%, 301,380 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +176 B, .text +64 B (+0.1%, 331,680 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +192 B (+0.2%, 241,999 B / 262,144 B, total: 92% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +192 B (+0.2%, 204,701 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +168 B, .text +192 B (+0.1%, 302,340 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +192 B (+0.2%, 242,063 B / 262,144 B, total: 92% used)

linuxkm-pie

• Data: __patchable_function_entries +88 B (+0.3%, 26,936 B)

linuxkm-standard

• Data: __patchable_function_entries +80 B (+0.2%, 49,744 B)

stm32-sim-stm32h753

• FLASH: .text +244 B (+0.1%, 188,452 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11299

Scan targets checked: wolfcrypt-port-bugs, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[mattia-moffa]

Jenkins retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11299

Scan targets checked: wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Reviewed bot's comments