Fix H2 frame reassembly across noise_recv() read boundaries — large MapResponse corruption (mined from Csontikka/microlink)

[fudio101]

Source

Csontikka/microlink commits cbdf1603, aad403af, 533f1f88, 46e34917, 017b3588 (H2/Headscale-compatibility series, ~270 LoC changes, ported from a shipping project esphome-tailscale), plus 372ca277 (single-stream MapRequest flow, net -78 LoC, verified against both Tailscale SaaS and Headscale).

Bug

Large MapResponses spanning multiple noise_recv() reads deterministically corrupt the H2 frame stream — surfaces as an "implausible message size" error. This is a genuine protocol-correctness bug in the H2 frame reassembly logic, independent of control-plane backend (affects Tailscale's own SaaS control plane, not just Headscale) — it would affect any tailnet whose MapResponse is large enough to span read boundaries (e.g. tailnets with many peers), which is directly relevant since we use Tailscale's SaaS control plane exclusively (per UPSTREAM_PRS.md's reasoning for skipping PR #22).

Scope note

The source commits are part of a larger Headscale-compatibility series (https:// login_server, TLS Noise-key fetch, netmap-via-long-poll for Headscale ≥0.26, stream-liveness watchdog, DERP relay retry-forever) that mostly doesn't apply to us since we run Tailscale's SaaS control plane, not Headscale (same reasoning UPSTREAM_PRS.md already applies to skip PR #22 in full). Extract only the frame-reassembly fix itself — the part that's backend-independent — not the Headscale-specific transport/polling changes.

Target files

components/microlink/src/ml_coord.c.

Tier 2 — worth pulling despite the Headscale-adjacent source, but needs careful extraction of just the reassembly logic. See FORK_PRS.md row 18.

[fudio101]

Closing without a fix. This is a real bug — poll_map_update() (the
COORD_LONG_POLL incremental-update handler in ml_coord.c) still does a
single noise_recv() per invocation and discards partial frames, unlike
do_fetch_peers() which #38 already fixed to reassemble safely across
noise_recv() boundaries.

Reproducing it needs a long-poll delta large enough to span a read
boundary, and nothing on the current 5-peer test tailnet has triggered
it — only the (already-fixed) initial-fetch path has been observed
spanning multiple frames. The source fix is a ~287±101 line diff
rewriting live parsing logic, not something to land blind against
live control-plane state.

Closing as deprioritized rather than leaving it open indefinitely with
no path to verification. Reopen if a tailnet large enough to trigger
this shows up, or a way to force a large incremental delta is found.