Fenrir fixes

[embhorn]

Fix f-6800: add SN refused-CONNACK test so a deleted return_code guard is caught
Fix f-6801: reject wildcard Response Topic in MqttEncode_Props to match the decoder
Fix f-6802: scrub retained topic/payload with BROKER_FORCE_ZERO in BrokerRetained_ReapExpired
Fix f-6803: scrub retained topic/payload with BROKER_FORCE_ZERO in BrokerRetained_DeliverToClient reap paths
Fix f-6804: route orphan out-queue frees through BrokerOutPub_Free so LWT/payload data is zeroed
Fix f-6805: recompute per-chunk length in streaming publish so the final chunk never over-reads the payload buffer

[Copilot]

Pull request overview

This PR hardens wolfMQTT against several regressions and spec-violations across MQTT-SN, MQTT v5 property encoding, broker retained-message handling, and streaming publish behavior.

Changes:

• Add regression tests covering MQTT-SN CONNACK refusal handling, v5 Response Topic wildcard rejection on encode, and streaming publish chunking/resume behavior.
• Enforce MQTT v5 Response Topic “no wildcards” at encode-time in MqttEncode_Props, matching decoder behavior and spec requirements.
• Ensure broker-owned topic/payload buffers are securely zeroed before free in additional retained/orphan cleanup paths, and fix streaming publish so final chunks never over-read caller buffers (including non-blocking resume).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wolfmqtt/mqtt_packet.h	Adds intBuf_cb_len to persist callback fill length across non-blocking publish re-entries.
src/mqtt_client.c	Fixes streaming publish chunk length handling (final chunk + non-blocking resume correctness).
src/mqtt_packet.c	Rejects wildcard Response Topic during property encoding per MQTT v5 requirements.
src/mqtt_broker.c	Routes more frees through secure-zero paths; scrubs retained topic/payload before free in additional reap/delete paths.
tests/test_mqtt_sn_client.c	Adds SN connect refusal regression test to ensure non-accepted CONNACK return codes surface as an error.
tests/test_mqtt_packet.c	Adds encode-side regression test for wildcard Response Topic rejection.
tests/test_mqtt_client.c	Adds streaming publish regression tests for final-chunk bounds, multi-fill behavior, and non-blocking resume.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #561

Scan targets checked: wolfmqtt-bugs, wolfmqtt-src

No new issues found in the changed files. ✅

[aidangarske]

Looks good