Merging this PR will not alter performance

✅ 14 untouched benchmarks

_{Comparing fix/bound-tc-deferred-queues (2c927fd) with master (8c9d6ce)¹}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.77%. Comparing base (8c9d6ce) to head (2c927fd).
⚠️ Report is 1 commits behind head on master.

@@           Coverage Diff           @@
##           master    #1751   +/-   ##
=======================================
  Coverage   99.77%   99.77%           
=======================================
  Files          33       33           
  Lines        3486     3497   +11     
  Branches      487      489    +2     
=======================================
+ Hits         3478     3489   +11     
  Misses          5        5           
  Partials        3        3           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@bluetoothbot review

PR Review — fix: bound TC-deferred queues against spoofed-source flood OOM

Solid DoS hardening. The two-tier cap (per-addr + total addrs) is the right shape for this class of bug, and FIFO eviction keyed off dict insertion order correctly prevents an active flooder from pinning slots by re-using a source IP. Ordering of the checks is sound: the eviction predicate (addr not in self._deferred and len >= cap) only fires for new addrs and guarantees _evict_oldest_deferred is never called on an empty dict; eviction cleans up _deferred, _timers (via the existing _cancel_any_timers_for_addr), and _deferred_deadlines consistently. Placing the per-addr cap check before the O(N) dedup scan is a nice secondary win — the scan is now O(_MAX_DEFERRED_PER_ADDR) = O(16) rather than O(N) in adversarial input.

Memory math checks out: 512 × 16 × _MAX_MSG_ABSOLUTE ≈ 72 MB, matching the PR description (the earlier 256/36MB number from one of Copilot's comments referred to a previous revision and is correctly updated). .pxd declarations match the C-int compare convention already used for _MAX_MSG_ABSOLUTE/_RECENT_PACKETS_MAX, so the hot path stays in cdef land. Tests pin the right invariants (per-addr cap, total-addrs cap, FIFO eviction identity) and correctly suppress timer firing via patch.object(_listener, "_TC_DELAY_RANDOM_INTERVAL", (60_000, 60_001)) to avoid the flakiness Copilot flagged on the earlier revision. Only nit is the docstring length on _evict_oldest_deferred vs. the repo's terse-docstring convention. Merge-ready.

🟢 Suggestions

    def _evict_oldest_deferred(self) -> None:
        """Discard the oldest deferred addr's reassembly state.

        Used when ``_MAX_DEFERRED_ADDRS`` would be exceeded; the
        evicted addr's queue and timer are dropped without firing, so
        the bound holds even when an attacker rotates source IPs.
        Eviction is FIFO (oldest by first-seen, via dict insertion
        order) rather than LRU so an active flooder cannot pin its
        slots by re-sending into the same addr.
        """

Checklist

• Per-addr and total caps are enforced before unbounded growth
• Eviction cannot be called on an empty _deferred (guarded by len >= cap)
• Eviction cleans _deferred, _timers, and _deferred_deadlines consistently
• FIFO (insertion-order) eviction resists pinning by an active flooder
• .pxd declarations match .py types (unsigned int) and cover the new helper
• Tests pin observable behavior (sizes, retained-set identity) without inspecting source
• Tests suppress TC-reassembly timer to remove timing flakiness on slow runners
• PR title is Conventional Commits + lowercase subject
• Docstrings follow project terse-single-line convention — suggestion ＃1
• RFC citation present for protocol-affecting bound (RFC 6762 §18.5)

Summary

Solid DoS hardening. The two-tier cap (per-addr + total addrs) is the right shape for this class of bug, and FIFO eviction keyed off dict insertion order correctly prevents an active flooder from pinning slots by re-using a source IP. Ordering of the checks is sound: the eviction predicate (addr not in self._deferred and len >= cap) only fires for new addrs and guarantees _evict_oldest_deferred is never called on an empty dict; eviction cleans up _deferred, _timers (via the existing _cancel_any_timers_for_addr), and _deferred_deadlines consistently. Placing the per-addr cap check before the O(N) dedup scan is a nice secondary win — the scan is now O(_MAX_DEFERRED_PER_ADDR) = O(16) rather than O(N) in adversarial input.

Memory math checks out: 512 × 16 × _MAX_MSG_ABSOLUTE ≈ 72 MB, matching the PR description (the earlier 256/36MB number from one of Copilot's comments referred to a previous revision and is correctly updated). .pxd declarations match the C-int compare convention already used for _MAX_MSG_ABSOLUTE/_RECENT_PACKETS_MAX, so the hot path stays in cdef land. Tests pin the right invariants (per-addr cap, total-addrs cap, FIFO eviction identity) and correctly suppress timer firing via patch.object(_listener, "_TC_DELAY_RANDOM_INTERVAL", (60_000, 60_001)) to avoid the flakiness Copilot flagged on the earlier revision. Only nit is the docstring length on _evict_oldest_deferred vs. the repo's terse-docstring convention. Merge-ready.

Automated review by Kōan2c927fd

@bluetoothbot review