Security & robustness fixes: 7 PRs (OOB reads, CSPRNG, overflow, pidfile, netmask, UB)

Security & robustness fixes — summary

A review of the codebase turned up a set of memory-safety and input-validation issues, most of them reachable from network input (DNS query/answer bytes and the server login reply). Each is fixed in its own PR, kept deliberately small so they can be reviewed and cherry-picked independently. All fixes are verified with an ASAN/UBSan harness run against the real source, and (where a libcheck test is practical) a regression test has been added to the tests/ suite.

Open PRs

#	Area	What it fixes	PR
1	DNS answer decode	dns_decode() read past the packet end on a truncated rlen (all 5 answer types) — network OOB read	#128
2	DNS name parsing	readname() OOB reads on truncated labels / compression pointers — network OOB read	#129
3	PRNG	protocol seeds, nonces & chunk ids drawn from rand()/srand() (predictable)	#130
4	Hostname builder	build_hostname() size_t underflow → ~2^64-byte heap overflow write; empty-buffer OOB read	#131
5	Client handshake	server-supplied CIDR prefix used unchecked → UB shift + /0 route injection	#132
6	Daemon pidfile	root fopen("w") follows symlinks + world-writable after umask(0) → local file write; fifo hang	#133
7	DNS cache	save_to_dnscache() reads fill before it is initialized (UB)	#134

Severity notes

• #128, #129 are the clearest "network attacker can trigger" memory bugs: both are out-of-bounds reads driven by crafted DNS packets, so they are primarily info-disclosure / crash (DoS) vectors.
• #130 removes predictable randomness from the seed/nonce/chunk-id that the protocol uses for its CMC and user seeding.
• #131 is a real write-overflow (from operator CLI args, not the network) but is included because it is unambiguous memory corruption.
• #132 turns a server-influenced value into a hard, validated check at both ends (defense in depth).
• #133 is a local-privilege issue (local unprivileged user vs. root daemon) plus a daemon-hang.
• #134 is a genuine use-before-initialization UB; the PR body notes it is not a memory-corruption bug (the sizeof index is a compile-time constant) and is fixed for correctness/UBSan-cleanliness.

Verification approach

Each PR links to a small ASAN/UBSan harness compiled against the actual src/ objects, showing the pre-fix failure (or the UB/behavior) and the clean post-fix run. tests/ regression tests were added for #128, #129, and #133 (the cases that fit the existing libcheck layout). Full make && make test is expected to run in CI across the platform matrix.

Happy to split, rebase, or retitle any of these if the maintainers would prefer a different granularity.