danielinux · Sep 29, 2026 · Sep 29, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026
diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
@@ -576,8 +576,6 @@ NO_TLSX_PSKKEM_PLAIN_ANNOUNCE
 NO_VAES_SUPPORT
 NO_VERIFY_OID
 NO_WC_DHGENERATEPUBLIC
-NO_WC_SHE_GETUID
-NO_WC_SHE_IMPORT_M123
 NO_WC_SHE_LOADKEY
 NO_WC_SSIZE_TYPE
 NO_WOLFSSL_ALLOC_ALIGN
@@ -848,11 +846,11 @@ WC_HASH_CUSTOM_MAX_DIGEST_SIZE
 WC_HASH_CUSTOM_MIN_DIGEST_SIZE
 WC_HAVE_FIPS_INDICATOR
 WC_INIT_ERROR_WHEN_CONTENDED
+WC_LINUXKM_FORCE_SVR_DYNAMIC_AUDITING
 WC_LINUXKM_NO_ENTROPY_DAEMON
 WC_LINUXKM_NO_SVR_DYNAMIC_AUDITING
 WC_LINUXKM_NO_USE_HEAP_WRAPPERS
 WC_LINUXKM_SPIN_IN_ATOMIC
-WC_LINUXKM_FORCE_SVR_DYNAMIC_AUDITING
 WC_MLDSA_NO_ASM
 WC_MLKEM_KERNEL_ASM
 WC_MPFS_ATHENA_NO_BASE_ADDR
@@ -863,8 +861,6 @@ WC_NO_RNG_SIMPLE
 WC_NO_STATIC_ASSERT
 WC_NO_VERBOSE_RNG
 WC_PKCS11_FIND_WITH_ID_ONLY
-WC_PKCS12_PBKDF_USING_MP_API
-WC_PUF_HELPER_COMPACT
 WC_PUF_SHA3
 WC_RNG_BANK_NO_DAEMON_SUPPORT
 WC_RNG_BANK_NO_DEFAULT_SUPPORT
@@ -891,7 +887,6 @@ WC_RSA_NO_FERMAT_CHECK
 WC_RTL8735B_NO_DERIVE_CACHE
 WC_RWLOCK_OPS_INLINE
 WC_SHA2_SMALL_STACK
-WC_SHE_SW_DEFAULT
 WC_SKIP_INCLUDED_C_FILES
 WC_SLHDSA_KERNEL_ASM
 WC_SLHDSA_NO_ASM
@@ -937,12 +932,8 @@ WOLFSSL_ALTERNATIVE_DOWNGRADE
 WOLFSSL_ALT_NAMES_NO_REV
 WOLFSSL_APACHE_MYNEWT
 WOLFSSL_ARM32_BUILD
-WOLFSSL_ARM32_PRIVILEGE_MODE
 WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP
-WOLFSSL_ARMASM_SHA3_NO_NEON
-WOLFSSL_ARMASM_SHA512_NO_NEON
 WOLFSSL_ARM_ARCH_NEON_64BIT
-WOLFSSL_ASCON_UNROLL
 WOLFSSL_ASN_EXTRA
 WOLFSSL_ATECC508
 WOLFSSL_ATECC508A_NOSOFTECC
@@ -983,18 +974,13 @@ WOLFSSL_CRL_ALLOW_MISSING_CDP
 WOLFSSL_CRYPTOCELL
 WOLFSSL_CRYPTOCELL_AES
 WOLFSSL_DEBUG_TRACE_ERROR_CODES_SUPPORT
-WOLFSSL_DILITHIUM_VERIFY_SMALLEST_MEM
 WOLFSSL_DISABLE_EARLY_SANITY_CHECKS
 WOLFSSL_DRBG_SHA256
-WOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID
-WOLFSSL_DTLS13_NO_HRR_ON_RESUME
 WOLFSSL_DTLS_DISALLOW_FUTURE
-WOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS
 WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT
 WOLFSSL_DUMP_MEMIO_STREAM
 WOLFSSL_DUP_CERTPOL
 WOLFSSL_EARLY_DATA_NO_ANTI_REPLAY
-WOLFSSL_ECC_BLIND_K
 WOLFSSL_ECC_GEN_REJECT_SAMPLING
 WOLFSSL_ECC_NO_SMALL_STACK
 WOLFSSL_ECC_SIGALG_PARAMS_NULL_ALLOWED
@@ -1009,7 +995,6 @@ WOLFSSL_ESPWROOM32
 WOLFSSL_EVP_PRINT
 WOLFSSL_EXPORT_INT
 WOLFSSL_EXPORT_SPC_SZ
-WOLFSSL_EXTRA
 WOLFSSL_FALCON_NO_NTT_DSP
 WOLFSSL_FALCON_SIGN_STATS
 WOLFSSL_FORCE_OCSP_NONCE_CHECK
@@ -1059,36 +1044,28 @@ WOLFSSL_MANUALLY_SELECT_DEVICE_CONFIG
 WOLFSSL_MCDC_ALLOC_SWEEP
 WOLFSSL_MDK5
 WOLFSSL_MICROCHIP_AESGCM
-WOLFSSL_MLDSA_ALLOW_WEAK_PREHASH
-WOLFSSL_MLDSA_CHECK_INVNTT_BOUND
-WOLFSSL_MLDSA_SIGN_SMALLEST_MEM
-WOLFSSL_MLDSA_TEST_REJ_NTT_FAIL
 WOLFSSL_MLDSA_VERIFY_ALLOW_MALLOC
 WOLFSSL_MLDSA_VERIFY_PRECOMP_A
 WOLFSSL_MLKEM_ASM_TEST
 WOLFSSL_MLKEM_INVNTT_UNROLL
 WOLFSSL_MLKEM_NO_MALLOC
 WOLFSSL_MLKEM_NTT_UNROLL
-WOLFSSL_ML_KEM_USE_OLD_IDS
 WOLFSSL_MONT_RED_CT
 WOLFSSL_MP_COND_COPY
 WOLFSSL_MP_INVMOD_CONSTANT_TIME
 WOLFSSL_MULTICIRCULATE_ALTNAMELIST
 WOLFSSL_MX2_CONF_INCLUDE
 WOLFSSL_NETX_DUO
 WOLFSSL_NEW_PRIME_CHECK
-WOLFSSL_NONBLOCK_OCSP
 WOLFSSL_NOSHA3_384
 WOLFSSL_NOT_WINDOWS_API
 WOLFSSL_NO_AES_KEY_SET_CHECK
 WOLFSSL_NO_BIO_ADDR_IN
-WOLFSSL_NO_CA_NAMES
 WOLFSSL_NO_CHACHA20_POLY1305_FUSED
 WOLFSSL_NO_CHACHA20_POLY1305_FUSED_IFMA
 WOLFSSL_NO_CHACHA20_POLY1305_SHORT
 WOLFSSL_NO_CHACHA20_POLY1305_SMALL_ASM
 WOLFSSL_NO_CLIENT_CERT_ERROR
-WOLFSSL_NO_COPY_CERT
 WOLFSSL_NO_COPY_KEY
 WOLFSSL_NO_CRL_DATE_CHECK
 WOLFSSL_NO_CRL_NEXT_DATE
@@ -1098,10 +1075,7 @@ WOLFSSL_NO_DECODE_EXTRA
 WOLFSSL_NO_DEL_HANDLE
 WOLFSSL_NO_DER_TO_PEM
 WOLFSSL_NO_DH186
-WOLFSSL_NO_DILITHIUM_LEGACY_GATES
 WOLFSSL_NO_DILITHIUM_LEGACY_NAMES
-WOLFSSL_NO_DTLS_SIZE_CHECK
-WOLFSSL_NO_ECC_SW
 WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK
 WOLFSSL_NO_ETM_ALERT
 WOLFSSL_NO_FCHMOD
@@ -1119,7 +1093,6 @@ WOLFSSL_NO_LMS_SHAKE256_256
 WOLFSSL_NO_OCSP_DATE_CHECK
 WOLFSSL_NO_OCSP_OPTIONAL_CERTS
 WOLFSSL_NO_RSA_KEY_CHECK
-WOLFSSL_NO_RSA_SW
 WOLFSSL_NO_SERVER_GROUPS_EXT
 WOLFSSL_NO_SESSION_STATS
 WOLFSSL_NO_SHA256_N_WAY
@@ -1130,7 +1103,6 @@ WOLFSSL_NO_SIGALG
 WOLFSSL_NO_SIGNER_DER_CERT
 WOLFSSL_NO_SOCKADDR_UN
 WOLFSSL_NO_STRICT_CIPHER_SUITE
-WOLFSSL_NO_TICKET_EXPIRE
 WOLFSSL_NO_TRUSTED_CERTS_VERIFY
 WOLFSSL_NO_WORD64_OPS
 WOLFSSL_NO_XOR_OPS
@@ -1147,7 +1119,6 @@ WOLFSSL_NXP_ELE_NO_TRNG_CHECK
 WOLFSSL_NXP_ELE_USE_DEVID
 WOLFSSL_NXP_HWPUF
 WOLFSSL_NXP_LPC55S6X
-WOLFSSL_OCSP_SCREEN_RESPONDER
 WOLFSSL_OLDTLS_AEAD_CIPHERSUITES
 WOLFSSL_OLD_SET_CURVES_LIST
 WOLFSSL_OLD_TIMINGPADVERIFY
@@ -1211,7 +1182,6 @@ WOLFSSL_SEC_QORIQ_NO_PKHA
 WOLFSSL_SEC_QORIQ_NO_RSA
 WOLFSSL_SEC_QORIQ_SWAP_REGS
 WOLFSSL_SERVER_EXAMPLE
-WOLFSSL_SESSION_CACHE_REF_WARNED
 WOLFSSL_SETTINGS_FILE
 WOLFSSL_SGX_CPUID_AVX512_VAES
 WOLFSSL_SHA256_ALT_CH_MAJ
@@ -1240,10 +1210,6 @@ WOLFSSL_STSAFE_TAKES_SLOT
 WOLFSSL_TELIT_M2MB
 WOLFSSL_TEMPLATE_EXAMPLE
 WOLFSSL_THREADED_CRYPT
-WOLFSSL_TI_AM64X_R5
-WOLFSSL_TI_AM64X_RNG_CTR_DRBG
-WOLFSSL_TI_AM64X_NO_AES
-WOLFSSL_TI_AM64X_NO_SHA
 WOLFSSL_TICKET_DECRYPT_NO_CREATE
 WOLFSSL_TICKET_ENC_AES128_GCM
 WOLFSSL_TICKET_ENC_AES256_CBC
@@ -1253,11 +1219,13 @@ WOLFSSL_TICKET_ENC_CHACHA20_POLY1305
 WOLFSSL_TICKET_ENC_HMAC_SHA384
 WOLFSSL_TICKET_ENC_HMAC_SHA512
 WOLFSSL_TINY_TLS13_NO_DEFAULT_CURVE
+WOLFSSL_TI_AM64X_NO_AES
+WOLFSSL_TI_AM64X_NO_SHA
+WOLFSSL_TI_AM64X_R5
+WOLFSSL_TI_AM64X_RNG_CTR_DRBG
 WOLFSSL_TI_CURRTIME
 WOLFSSL_TLS13_DRAFT
 WOLFSSL_TLS13_IGNORE_AEAD_LIMITS
-WOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC
-WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT
 WOLFSSL_TLS13_TICKET_BEFORE_FINISHED
 WOLFSSL_TLS13_TICKET_CHECK_PSK_MODES
 WOLFSSL_TLSX_PQC_MLKEM_STORE_PRIV_KEY
@@ -1278,7 +1246,6 @@ WOLFSSL_VALIDATE_MLDSA_KEYGEN
 WOLFSSL_VALIDATE_MLKEM_KEYGEN
 WOLFSSL_VALIDATE_SLHDSA_KEYGEN
 WOLFSSL_VAULTIC_DEBUG
-WOLFSSL_VERBOSE_LOGGING
 WOLFSSL_VERSAL_GEN2_ASU_CCM_ALIGN_DECLINE
 WOLFSSL_VERSAL_GEN2_ASU_CTR_WRAP_HW_FIXED
 WOLFSSL_VERSAL_GEN2_ASU_DEBUG
@@ -1303,7 +1270,6 @@ WOLFSSL_X509_KEY_GEN
 WOLFSSL_X509_PEM
 WOLFSSL_X509_STORE_ALLOW_NON_CA_INTERMEDIATE
 WOLFSSL_X509_STORE_CERTS
-WOLFSSL_X509_TINY
 WOLFSSL_X509_TRUSTED_CERTIFICATE_CALLBACK
 WOLFSSL_X509_VERIFY_ONLY
 WOLFSSL_XFREE_NO_NULLNESS_CHECK
@@ -1315,10 +1281,7 @@ WOLFSSL_ZEPHYR_MAIN_ARGS
 WOLFSSL_nRF5x_SDK_15_2
 WOLF_ALLOW_BUILTIN
 WOLF_CONF_ASN_TIME
-WOLF_CRYPTO_CB_ASYNC_POLL
-WOLF_CRYPTO_CB_KEYGEN_SW_FALLBACK
 WOLF_CRYPTO_CB_ONLY_SHA
-WOLF_CRYPTO_CB_SHAKE_XOF
 WOLF_CRYPTO_DEV
 WOLF_NO_TRAILING_ENUM_COMMAS
 WindowsCE

diff --git a/src/ssl.c b/src/ssl.c
@@ -3871,16 +3871,20 @@ int wolfssl_local_IsValidFQDN(const char* name, word32 nameSz)
     int curLabelHasAlpha = 0;
     int curLabelHasUnderscore = 0;
 
-    if (name == NULL || nameSz == 0)
+    if (name == NULL || nameSz == 0 || nameSz > 254)
         return 0;
 
+    /* Bound before touching name[]: a valid name is at most 253 octets
+     * plus an optional trailing dot, so longer sizes are rejected here
+     * without reading past the caller's buffer.
+     */
     /* Strip a single optional trailing dot before measuring.  "example.com."
      * is the absolute form of the same FQDN.
      */
     if (name[nameSz - 1] == '.')
         --nameSz;
 
-    if (nameSz < 1 || nameSz > 253)
+    if (nameSz > 253)
         return 0;
 
     for (i = 0; i < nameSz; i++) {

diff --git a/tests/api/check-api-guards.py b/tests/api/check-api-guards.py
@@ -64,6 +64,13 @@
     'wolfSSL_CertManagerVerify':     (['NO_FILESYSTEM'], []),
     'wolfSSL_CertManagerLoadCRL':    (['NO_FILESYSTEM'], []),
     'wolfSSL_CertManagerLoadCRLFile': (['NO_FILESYSTEM'], []),
+    # src/ssl.c: implemented under HAVE_SECURE_RENEGOTIATION ||
+    # HAVE_SERVER_RENEGOTIATION_INFO; the substring match passes a call
+    # site guarded by the full disjunction.
+    'wolfSSL_SSL_renegotiate_pending':  ([], ['HAVE_SECURE_RENEGOTIATION']),
+    # src/ssl_load.c: implemented under !NO_FILESYSTEM && !NO_CERTS
+    'wolfSSL_CTX_use_PrivateKey_file':  (['NO_FILESYSTEM', 'NO_CERTS'], []),
+    'wolfSSL_CTX_use_certificate_file': (['NO_FILESYSTEM', 'NO_CERTS'], []),
 }