More fuzz tests and small fixes for the findings (#10864)

* first pass tests

* more tests

* Fix two crafted-admin-packet crashes found by the E5 fuzzer

Both are reachable from an authorized admin (local from==0, admin channel,
or PKC) - remote DoS:

1. SIGFPE in LoRa config validation. A set_config LoRaConfig with
   use_preset=false and bandwidth=0 makes freqSlotWidth 0, so numFreqSlots
   is 0 and `hash(name) % numFreqSlots` (RadioInterface.cpp) divides by
   zero. Guard the modulo; the existing channel_num check then rejects/
   clamps the config.

2. Stack overflow in Channels::getKey. A SECONDARY channel at the primary
   slot with an empty PSK recursed into getKey(primaryIndex) forever. Skip
   the primary-key borrow when chIndex == primaryIndex.

Re-enable the E5 admin fuzzer to hit both triggers again (use_preset both
ways incl. bandwidth 0, plus the set_channel tag) as regression guards.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Correct fuzz-test invariants after the crash fixes

- E5 admin fuzz: node eviction under a filling NodeDB is legitimate, so
  assert only the bounded-count invariant, not that a specific seed node
  survives 6000 mutating ops.
- TMM blitz: scope off the nodeinfo direct-response send path (it needs a
  fully-wired MeshService/phone queue the fixture doesn't provide; the
  deterministic directResponse tests cover it). The crafted-nodenum
  rate/unknown/position cache stress is unchanged.

clod helped too

* realistic tests

* test: dedup fuzz RNG into shared test/support/DeterministicRng.h

The four in-tree fuzz suites (test_fuzz_decode, test_fuzz_packets,
test_hop_scaling, test_traffic_management) each carried a byte-identical
copy of the seeded 64-bit LCG (rngSeed/rngNext/rngByte/rngRange). Hoist
it into one shared header so there is a single generator to reason about
and no risk of the copies drifting. static inline keeps per-suite state
per translation unit and avoids -Wunused-function for suites that don't
use every helper. Also corrects a stale comment in test_traffic_management
(the blitz's nodeinfo direct-response path is intentionally left off).

No behavioral change: same constants, same per-suite seeds.

clod helped too

* test: fuzz uncovered ProtobufModule handlers and the MQTT downlink ingress

Extend the in-tree fuzz coverage to packet sources that previously had
none:

- test_fuzz_packets E8/E9/E10: drive PositionModule, DeviceTelemetryModule
  and NeighborInfoModule at handleReceivedProtobuf directly (via using-shims,
  bypassing the ProtobufModule reply/send path so no router is needed). The
  fixture already stands up nodeDB/service/channels, and nodeStatus/powerStatus
  are auto-initialized in main.cpp, so no new globals are required. Adds a
  shared fuzzRxHeader() helper for crafting adversarial RX packet headers.
- test_fuzz_decode: add meshtastic_KeyVerification to the decode table. The
  KeyVerification and StoreForward handler paths are documented as decode-level
  only, with the concrete reason each is intrinsic (private-state gating /
  PSRAM + self-pointer wiring), not a fixture gap.
- test_mqtt: test_receiveFuzzServiceEnvelope blitzes the non-RF broker-push
  ingress (onReceiveProto) two ways - raw garbage bytes that must fail envelope
  decode cleanly, and a well-formed ServiceEnvelope wrapping a crafted inner
  MeshPacket over crafted channel_id/gateway_id - exercising the channel match,
  isFromUs, XEdDSA receive policy and perhapsDecode chain. Adds a deliverRaw()
  passthrough to MQTTUnitTest.

All under the coverage env (ASan/LSan). No firmware/src changes. Full sweep
GREEN 27/27, 544 cases.

clod helped too

* Harden LoRa/channel config against crafted admin messages; consolidate test helpers

Production (review findings on the hot-fuzz crash fixes):
- Clamp bandwidth at the source (clampBandwidthKHz) in checkOrClampConfigLora
  and applyModemConfig so numFreqSlots can never be 0 for any consumer; a
  bandwidth-0 set_config previously passed validation and re-armed the SIGFPE
  on the next applyModemConfig.
- Guard applyModemConfig's hash % numFreqSlots (the validator's sibling modulo
  was fixed earlier but this one was still unguarded).
- Enforce the primary-channel invariant in Channels::onConfigChanged: a config
  demoting every slot now re-promotes the stale SECONDARY slot (keeping its
  key) or restores the default channel if the slot is DISABLED, instead of
  leaving every getPrimaryIndex() reader on a non-primary slot. The getKey
  recursion guard stays as defense-in-depth.

Tests:
- New test/support/MockMeshService.h and AdminModuleTestShim.h replace four
  byte-identical mocks and three divergent admin shims (test_mqtt's capturing
  mock is genuinely different and stays).
- DeterministicRng.h: add rngFill() (replaces 14 hand-rolled fill loops) and
  rngEdgeNodeNum() (unifies the three NodeNum boundary pools).
- Extract fuzzChannelSettings() shared by the set_channel case and fuzzBeacon.
- fuzzBeacon: the un-terminated branch now fills the whole buffer with non-NUL
  bytes so the strnlen bound is actually stressed (~50% of iterations, not ~4%).
- E6 beacon fuzz: replace the TEST_ASSERT_TRUE(true) tautology with real
  invariants (handler never consumes; offers land in lastReceivedOffer keyed
  to the sender).
- Trim the seven over-long comment blocks flagged against the 1-2 line rule;
  the FINDINGS trailer moves to this commit message (see production notes).

Full native suite GREEN 27/27 under the coverage (ASan/LSan) env.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Clamp UTF-8 char length in the emote walkers; add test_fuzz_emotes

A TEXT_MESSAGE payload is opaque protobuf bytes, so PB_VALIDATE_UTF8 never
screens it - invalid UTF-8 and truncated multi-byte lead bytes reach the
emote/width render path verbatim. EmoteRenderer's walkers advanced by
utf8CharLen(lead) without clamping to the bytes actually remaining, so a
truncated lead (e.g. a lone 0xF0, which claims 4 bytes) near the end of the
buffer made getUtf8ChunkWidth's memcpy read past the string. ASan confirms a
heap-buffer-overflow READ from measureStringWithEmotes.

Add utf8CharLenClamped() and use it at every walk site (width measure,
truncation cut-loop, and the draw-path text-run/chunk builders); the one
already-guarded site (matchAtIgnoringModifiers) is unchanged.

New test/test_fuzz_emotes drives measureStringWithEmotes and truncateToWidth
over adversarial byte strings (biased to embed/end in truncated multi-byte
leads) in exact-sized heap buffers so any over-read is a hard ASan fault. Its
headless display uses a synthetic font (firstChar 0, fontData centered in a
large buffer) so the stock OLEDDisplay::getStringWidth - which indexes the
font jump table with a signed char and over-reads for any byte >= 0x80 - does
not mask the finding. native-suite-count bumped 27 -> 28.

Full native suite GREEN 28/28 under the coverage (ASan/LSan) env.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Keep emote width measurement in-bounds for non-ASCII bytes

OLEDDisplay::getStringWidth (the utf8=false path EmoteRenderer uses on default
builds) indexes the font jump table by (c - firstChar) with a signed char and
no bounds check, so any byte outside printable ASCII - high bytes from UTF-8
text, but also a stray control byte like 0x0A - reads outside the font array.
On-device this reads adjacent flash and returns a garbage width; under ASan the
test_fuzz_emotes fuzzer flags it as a global-buffer-overflow, and it made the
non-ASCII width measurement meaningless either way.

The OLED driver is a pinned upstream dependency, so guard it firmware-side in
EmoteRenderer's getStringWidth helper: measure a sanitized copy where any byte
outside [0x20, 0x7E] counts as a '?' placeholder. Printable ASCII is unchanged
and the UA/RU lookup path is untouched.

test_fuzz_emotes now drives a real ArialMT font instead of the synthetic
in-bounds font it needed before this fix, so the suite exercises the true
production width path (utf8CharLen clamp + this sanitizer) end to end. The same
fuzzer tripped the global-buffer-overflow before this change.

Full native suite GREEN 28/28 under the coverage (ASan/LSan) env.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

test/test_traffic_management/test_main.cpp

@@ -18,6 +18,7 @@
 #include "mesh/NodeDB.h"
 #include "mesh/Router.h"
 #include "modules/TrafficManagementModule.h"
+#include "support/DeterministicRng.h" // rngSeed/rngNext/rngRange - shared seeded LCG
 #include <climits>
 #include <cstring>
 #include <memory>
@@ -1600,6 +1601,92 @@ static void test_tm_lostAndFoundRole_getsAlterReceivedPrecisionClamp(void)
     // channels always have a public PSK so getPositionPrecisionForChannel caps at 15.
     TEST_ASSERT_EQUAL_UINT32(13, out.precision_bits);
 }
+
+// ---------------------------------------------------------------------------
+// Fuzz - crafted-nodenum blitz of the unified cache
+// ---------------------------------------------------------------------------
+// Floods handleReceived/alterReceived with crafted packets over a tiny node pool so the fixed-size
+// cache churns hard while the virtual clock sweeps the rate/unknown/position windows; no crash, counters bounded.
+static constexpr uint64_t FUZZ_SEED = 0x00D07E5701ULL;
+
+static void test_tm_fuzz_nodenum_blitz(void)
+{
+    printf("  seed=0x%llx\n", (unsigned long long)FUZZ_SEED);
+    rngSeed(FUZZ_SEED);
+
+    // Activate the cache-tracked windows (the crafted-nodenum target). The nodeinfo direct-response
+    // path (nodeinfo_direct_response_max_hops) is left OFF: it calls service->sendToMesh, and driving
+    // that at fuzz volume needs a fully-wired MeshService/phone queue this fixture doesn't provide - the
+    // deterministic test_tm_nodeinfo_directResponse_* tests cover it with single packets instead.
+    moduleConfig.traffic_management.rate_limit_window_secs = 60;
+    moduleConfig.traffic_management.rate_limit_max_packets = 3;
+    moduleConfig.traffic_management.unknown_packet_threshold = 4;
+    moduleConfig.traffic_management.position_min_interval_secs = 300;
+    config.device.role = meshtastic_Config_DeviceConfig_Role_CLIENT;
+    installWellKnownPrimaryChannel();
+
+    static TrafficManagementModuleTestShim module; // static: OSThread-derived (see note in test_fuzz_packets E2)
+
+    // Shared boundary pool (0/1/broadcast) plus this suite's well-known nodes.
+    const NodeNum wellKnown[] = {kLocalNode, kRemoteNode, kTargetNode};
+    const size_t wellKnownN = sizeof(wellKnown) / sizeof(wellKnown[0]);
+    const meshtastic_PortNum ports[] = {
+        meshtastic_PortNum_TEXT_MESSAGE_APP, meshtastic_PortNum_NODEINFO_APP, meshtastic_PortNum_POSITION_APP,
+        meshtastic_PortNum_ROUTING_APP,      meshtastic_PortNum_ADMIN_APP,    meshtastic_PortNum_TELEMETRY_APP,
+    };
+    const size_t portsN = sizeof(ports) / sizeof(ports[0]);
+
+    const unsigned ITERS = 30000;
+    for (unsigned k = 0; k < ITERS; k++) {
+        meshtastic_MeshPacket p = meshtastic_MeshPacket_init_zero;
+        p.from = (rngRange(8) == 0) ? (NodeNum)rngNext() : rngEdgeNodeNum(wellKnown, wellKnownN);
+        p.to = rngEdgeNodeNum(wellKnown, wellKnownN);
+        p.id = rngNext();
+        p.channel = 0;
+        p.hop_start = (uint8_t)rngRange(8); // 0..7, wire-bounded
+        p.hop_limit = (uint8_t)rngRange(8);
+        p.decoded.want_response = (rngRange(2) == 0);
+
+        if (rngRange(5) == 0) {
+            // Undecoded / unknown packet - exercises the unknown-packet threshold path.
+            p.which_payload_variant = meshtastic_MeshPacket_encrypted_tag;
+            p.encrypted.size = rngRange(sizeof(p.encrypted.bytes) + 1);
+            rngFill(p.encrypted.bytes, p.encrypted.size);
+        } else {
+            p.which_payload_variant = meshtastic_MeshPacket_decoded_tag;
+            p.decoded.portnum = (rngRange(8) == 0) ? (meshtastic_PortNum)rngRange(80) : ports[rngRange(portsN)];
+            p.decoded.has_bitfield = true;
+            p.decoded.bitfield = (uint32_t)rngNext();
+            if (p.decoded.portnum == meshtastic_PortNum_POSITION_APP && rngRange(2)) {
+                meshtastic_Position pos = meshtastic_Position_init_zero;
+                pos.has_latitude_i = true;
+                pos.has_longitude_i = true;
+                pos.latitude_i = (int32_t)rngNext();
+                pos.longitude_i = (int32_t)rngNext();
+                pos.precision_bits = rngRange(40); // includes >32 (the default-precision fallback)
+                p.decoded.payload.size =
+                    pb_encode_to_bytes(p.decoded.payload.bytes, sizeof(p.decoded.payload.bytes), &meshtastic_Position_msg, &pos);
+            } else {
+                // Random payload bytes: TMM's nested User/Position decode must fail cleanly.
+                p.decoded.payload.size = rngRange(sizeof(p.decoded.payload.bytes) + 1);
+                rngFill(p.decoded.payload.bytes, p.decoded.payload.size);
+            }
+        }
+
+        (void)module.handleReceived(p);
+        if (rngRange(3) == 0)
+            module.alterReceived(p);
+
+        // Advance the virtual clock so rate / unknown / position windows open and close under churn.
+        if (rngRange(16) == 0)
+            TrafficManagementModule::s_testNowMs += (rngRange(120) + 1) * 1000u;
+        if (rngRange(1024) == 0)
+            (void)module.runOnce(); // maintenance sweep: cache aging / eviction
+    }
+
+    // The cache never inspected more packets than we fed, and the run reached here without an ASan fault.
+    TEST_ASSERT_TRUE_MESSAGE(module.getStats().packets_inspected <= ITERS, "packets_inspected overcounted");
+}
 } // namespace
 
 void setUp(void)
@@ -1669,6 +1756,7 @@ TM_TEST_ENTRY void setup()
     RUN_TEST(test_tm_lostAndFoundRole_getsAlterReceivedPrecisionClamp);
     RUN_TEST(test_tm_unknownRole_noDbEntry_appliesFullInterval);
     RUN_TEST(test_tm_unknownRole_noUserBit_appliesFullInterval);
+    RUN_TEST(test_tm_fuzz_nodenum_blitz);
     exit(UNITY_END());
 }