[floitsch]

Nonblocking receives can return WANT_READ after only part of a TLS record header. The dynamic RX wrapper retains the received-byte count but stores the header bytes on the stack, so a later call can process a corrupted header and fail with MBEDTLS_ERR_SSL_INVALID_RECORD.

Preserve partial headers in the connection's idle RX buffer, adding five bytes after the counter/IV cache. Allocate the full record buffer before releasing that cache so allocation failure also preserves the input and cryptographic state for a retry.

Add Unity regression tests and a dynamic-buffer CI configuration covering all header split positions, repeated WANT_READ, interleaved connections, buffer reuse, counter/IV preservation, and close/reset buffer paths after partial reads, timeout, or EOF.

Validation:

• The regression source fails with the original wrapper and passes with the fix in the host harness.
• 54 verified TLS 1.2 transfer cases pass across AES-CBC, AES-GCM, and ChaCha20-Poly1305, including 1–4-byte receives, zero-length read probes, and peer-certificate retention on/off.
• Host allocation-failure injection and AddressSanitizer memory-access checks pass; explicit allocation tracking returns to zero after the successful tests.
• ESP32 regression-test firmware builds with dynamic buffers and comprehensive heap poisoning. Physical-board execution remains outstanding.

Based on the current patch-head-5.4.2 head. Its mbedTLS files match the version used for validation.