https://gitlab.synchro.net/main/sbbs/-/commit/9e122282f4d0cea9f7b9da6a
Modified Files:
src/ssh/README.md TODO.md deucessh-auth.h server.c ssh-auth.c ssh-conn.c src/ssh/test/CMakeLists.txt test_alloc.c test_auth.c test_conn.c
Log Message:
Fix 2 bugs: accept_channel data race, auth username buffer overflow (items 52, 8)

Item 52: dssh_session_accept_channel() setup-to-normal transition now
holds buf_mtx. chan_type, buffer union, window_max, and callbacks are initialized atomically; setup_mode set to false last. Prevents demux
thread from seeing partially initialized channel state.

Item 8: dssh_auth_server() username_out_len is now in/out Ä input is
buffer capacity, output is bytes written. Prevents overflow when
caller buffer is smaller than the internal 255-byte cap. All callers
updated. New test auth/server/small_username_buffer verifies truncation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net