Data-plane follow-ups & investigations (umbrella)

[vxfemboy]

Smaller deferrals / follow-ups / things-to-investigate accumulated across the throughput pass, feedback+ARQ, and io_uring Phase A milestones. Each is bounded; none blocks current work.

Correctness / robustness

• Wire-auth object_id binding (M5/M6 carry-forward). object_id (u16) and object_size are attacker-forgeable on the wire; a forged object_id can LRU-evict a live object in the reassembler. Bind them to authenticated peer/epoch context. Also: u16 wraps every 65536 objects (currently unreachable within the bounded retx/reassembler windows, but relevant if rates rise or windows grow).
• Loss-detector partial-receive limitation (documented in lossdetect.rs). The gap model reports fully-absent counters and, since PR Data-plane follow-ups: ARQ integrity test, detector completeness, retx sizing, hardening #4, seen-but-undecoded counters too — but the seen-but-undecoded suppression (resolved_set) is best-effort under extreme reordering (evicted-far-above-watermark → a benign spurious NACK the sender drops). Exact for the single-symbol zero-repair case. Revisit if heavy-loss multi-symbol accuracy matters.
• Per-class loss denominator is a conservative approximation (sent-log residency → biases the fraction high → over-repair, safe). An exact per-class windowed rate is hard (receiver knows window totals but not classes; sender knows classes but not the receiver's window). Only worth it if over-repair-under-loss becomes a measured cost.
• Deadline-based FEC eviction: FlowParams.deadline is only partially honored (LRU-count eviction dominates). Honor per-class deadlines for reassembler eviction + ARQ eligibility.
• Bidirectional flow accounting: the M5.5 classifier heuristic observes egress only.

Performance / cleanup

• drain_tun to_vec() clone (yip-io/poll.rs, Phase A): clones the egress scratch to drop the &mut DataPlane borrow before sending. Negligible now; a candidate to eliminate in the io_uring pass (io_uring busy-poll Phase B: UringDriver (status + remaining work) #7) by splitting the borrow.
• AF_XDP backend: still a stub. The second kernel-bypass I/O tier after io_uring (io_uring busy-poll Phase B: UringDriver (status + remaining work) #7).

Anti-DPI hooks still live in the data plane (feed sub-project #3)

• Static 1-byte PacketType prefix (Data=2/Control=3/handshake) + fixed handshake prefixes — a DPI signature. Fold into keyed header-protection.
• Static conn_tag = linkability signature — rotate per epoch (tied to rekey, Milestone: session rekey (~120s rotation) + PQ-hybrid handshake path #9).

Broader roadmap (each a future sub-project, own design→build)

• Sub-project Data-plane throughput pass: batched I/O + zero-repair FEC bypass #2 — control plane: decentralized discovery (DHT/gossip), self-certifying key-derived addresses, NAT hole-punching (rendezvous + UDP punch), relay fallback. yipd is currently two static hand-configured peers — this is "the real work" per CLAUDE.md.
• Sub-project Adaptive loss-feedback loop + reactive ARQ #3 — anti-DPI/obfuscation: the two anti-DPI items above + AmneziaWG recipe (junk/padding/jitter), optional REALITY TLS-mimicry, nDPI/nDPId wired into CI.
• Sub-project Data-plane follow-ups: ARQ integrity test, detector completeness, retx sizing, hardening #4/CI: guard the under-loss + ARQ-integrity netns tests #5: DAITA/anonymity (Arti); hardening/multi-platform (macOS/Windows).

Bench polish (optional)

• ZeroTier + AmneziaWG bench contenders (named in the brief, not installed).
• OpenVPN currently benched with TLS+AES-256-GCM (good); could add a UDP-under-loss column for WG/OpenVPN/n2n.
• 1000-ping samples to tighten netem loss-rate variance.