kerykeion: 30 low-severity audit findings (wave-1 batch)

[forkwright]

Findings

correctness

• crates/kerykeion/src/crypto.rs:58 — resolve_psk mishandles single-byte PSK index 0 (cleartext) and indices above 10 (low)
• crates/kerykeion/src/crypto.rs:156 — Distinguish PSK-misconfiguration from a failed trial-decrypt in the channel loop (low)
• crates/kerykeion/src/collector.rs:356 — Report total connection/handshake failure rather than exiting Ok with only a warning (low)
• crates/kerykeion/src/processor.rs:139 — Attach correct per-event location instead of the packet sender's position to all emitted signals (low)
• crates/kerykeion/src/config.rs:100 — Validate ChannelPsk length at config load instead of failing late with an opaque encryption error (low)
• crates/kerykeion/src/processor.rs:209 — Do not silently collapse an out-of-range hw_model to 0 (UNSET) without logging (info)

resilience

• crates/kerykeion/src/collector.rs:212 — Do not hold the node_db mutex across the full handshake network await (low)
• crates/kerykeion/src/collector.rs:485 — Start the inflight ACK timeout after transmit, not before, in router flush (low)
• crates/kerykeion/src/topology.rs:356 — Dedup and bound topology snapshot restore in load_from_bytes (low)
• crates/kerykeion/src/processor.rs:142 — Account for lagging-consumer signal loss on the GeoSignal broadcast emit path (low)

security

• crates/kerykeion/src/handshake.rs:107 — Bound per-handshake node and channel accumulation against a hostile radio/TCP peer (low)
• crates/kerykeion/src/crypto.rs:161 — Do not treat a successful trial-decrypt as trustworthy channel attribution (low)
• crates/kerykeion/src/collector.rs:127 — Stop trusting OTA hop fields as firmware-bounded when deriving hop_count (low)
• crates/kerykeion/src/outbound.rs:109 — Cap the outbound pending queue to bound memory and insertion cost (low)
• crates/kerykeion/src/topology.rs:47 — Cap topology graph growth driven by attacker-chosen OTA node IDs (low)
• crates/kerykeion/src/processor.rs:162 — Validate untrusted hop_start/hop_limit before inferring direct links (low)
• crates/kerykeion/src/processor.rs:255 — Validate decoded position latitude/longitude before persisting to the node DB (low)

testing

• crates/kerykeion/src/handshake.rs:124 — Cover the config_complete_id mismatch branch in the handshake state machine (low)
• crates/kerykeion/src/handshake.rs:173 — Test NodeInfo to MeshNode field conversions (lat/lon scale, timestamps, hops) (low)
• crates/kerykeion/src/router.rs:180 — Cover the NAK-after-max-retries failure mapping in MeshRouter::handle_nak (low)
• crates/kerykeion/src/delivery.rs:199 — Add a test for DeliveryTracker::prune_completed retention rules (low)
• crates/kerykeion/src/collector.rs:483 — Exercise the drain/send tick branch of run_router_flush (low)
• crates/kerykeion/src/bridge.rs:226 — Test the failover-cooldown guard in GatewayBridge::ensure_active (low)
• crates/kerykeion/src/processor.rs:556 — Test the NAK-triggers-retry branch of apply_routing_result (low)
• crates/kerykeion/src/processor.rs:417 — Test traceroute reverse-path (snr_back/back) link insertion (low)
• crates/kerykeion/src/processor.rs:197 — Test that malformed OTA protobuf payloads are handled without panic (low)
• crates/kerykeion/src/processor.rs:215 — Test that a repeat NODEINFO for a known node suppresses NodeDiscovered (low)
• crates/kerykeion/src/signals.rs:171 — Test the invalid-coordinate fallback in convert_position_update (low)
• crates/kerykeion/src/message.rs:181 — Test the encryption-error return path of MessageBuilder::build (low)
• crates/kerykeion/src/signals.rs:115 — Test signal conversion for LinkDegraded, PartitionHealed, and GatewayStatusChange events (low)

Note

These are batched low/info findings; split any out if it gets prioritized.

[forkwright]

Reopening after a clause-level audit of the release-generated closure against exact main@ffa416fc.

The batch was not complete. Multiple named findings remain directly visible:

• crypto.rs:60-69 still treats only one-byte PSK indices 1-10 specially; index 0 and indices above 10 fall through as invalid one-byte AES keys.
• config.rs:89-102 still deserializes ChannelPsk.psk without validating the documented lengths.
• crypto.rs:154-169 still swallows per-key initialization errors and accepts any protobuf-decodable trial plaintext as channel attribution.
• handshake.rs:90-115 still accumulates peer-supplied nodes/channels without a bound.
• collector.rs:120-127 and processor.rs:193-199 still trust/cast OTA hop fields without enforcing the claimed firmware bound.
• outbound.rs:80-136 still has no bound on the pending queue.
• processor.rs:293-318 still persists decoded latitude/longitude without range validation.

The release PR auto-closed the aggregate despite those clauses. Keep credited fixes in place, but leave this issue open until every surviving finding is fixed or moved to an explicit open successor with body-level ownership; do not close an aggregate merely because one implementation wave landed.