[aidangarske]

F-10934 - 2121efa - The ALPN mismatch option constants are now bound to wolfSSL's enum values, so a failed on mismatch option aborts the handshake.

F-1870 - 435621a - The ASN1 parse wrapper now frees the decoded object and clears the pointer when the DER offset check fails.

F-3523 - ad80b10 - WolfSSL_d2i_X509 now copies the DER input into C memory first, which stops the cgo pointer check panic on every call.

F-5328 - c50730e - WolfSSL_CTX_load_verify_locations now receives the CA directory path instead of dropping it.

F-10951 - 20ff00f - The peer chain getter now returns no chain when any entry cannot be read, instead of a silently shortened chain.

F-7866 - a1ed747 - The TLS version constants are now bound to wolfSSL's TLS1_x_VERSION values.

F-9638 - 5c49be6 - The SNI and ALPN wrappers now reject name and protocol lengths that overflow the C parameter width.

F-9642 - 9df855a - The domain name wrappers now reject names containing an embedded NUL byte.

F-10956 - f3435bd - The certificate, key and CA path wrappers now reject paths containing an embedded NUL byte.

F-12017 - 922d43c - The ASN1 parse wrappers now reject nil arguments instead of dereferencing them.

F-12023 - f9a7db1 - The Authority Key Identifier getter now returns identifiers longer than 64 bytes instead of an empty value.

F-12051 - 68eeab2 - ParseCertificate now returns ErrInvalidCert when the serial number cannot be read, instead of a serial of 0.

F-12053 - 14a71ea - The DTLS peer address wrappers now reject negative or oversized address sizes.

F-12055 - 0b36d2c - The X509 store path wrappers now reject paths containing an embedded NUL byte.

F-12845 - 8bc231b - The OID text wrappers now reject strings containing an embedded NUL byte.

F-12846 - c744088 - The DTLS peer address wrappers now reject addresses containing an embedded NUL byte.

F-12847 - 6054525 - The PSK identity hint wrappers now reject hints containing an embedded NUL byte.

F-14917 - 781f665 - The peer chain getter now bounds checks the chain index before reading an entry.

F-9665 - 07408f5 - WolfSSL_i2d_X509 now treats a nil output as a length query instead of crashing and leaking.

CI - d83cf97 - The build workflow now runs go test on the root package in the full config.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #66

Scan targets checked: go-wolfssl-src, go-wolfssl-bugs
Coverage: 3 of 6 in-scope changed file(s) opened by the reviewer; not opened: ssl_x509_wrapper_helpers.go, ssl_x509_wrappers_test.go, wolfx509/serial_number_test.go

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite