Issues

• http2: DATA on an idle stream is accepted instead of a PROTOCOL_ERROR

  bugseverity:low
  MDA2AV/ioxide#354 · Filter by author MDA2AV opened on Oct 12, 2026

• http2: a buffered response is bounded by the connection window only, and can overrun the peer's stream window

  bugseverity:medium
  MDA2AV/ioxide#353 · Filter by author MDA2AV opened on Oct 12, 2026

• h3/nghttp3: a connection that did not negotiate h3 is served

  bugseverity:low
  MDA2AV/ioxide#352 · Filter by author MDA2AV opened on Oct 12, 2026

• http3: closing or resetting the peer's control stream is ignored instead of H3_CLOSED_CRITICAL_STREAM

  bugseverity:low
  MDA2AV/ioxide#351 · Filter by author MDA2AV opened on Oct 12, 2026

• http3: a request body shorter than its content-length is served instead of refused

  bugseverity:medium
  MDA2AV/ioxide#350 · Filter by author MDA2AV opened on Oct 12, 2026

• sni/quic: a second ClientHello naming a different host is not refused

  bugseverity:medium
  MDA2AV/ioxide#349 · Filter by author MDA2AV opened on Oct 12, 2026

• StackExchange.Redis transport seam: a transport connection's close is not reported (no ConnectionFailed, in-flight commands cancelled)

  MDA2AV/ioxide#336 · Filter by author MDA2AV opened on Oct 12, 2026

• tcp: a zero-copy send has no upper bound on how long it can pin an fd and its slab

  MDA2AV/ioxide#245 · Filter by author MDA2AV opened on Sep 21, 2026

• reactor: Teardown never disposes live or pooled TcpConnections, so every Stop() leaks their native write slabs

  bugseverity:low
  MDA2AV/ioxide#223 · Filter by author MDA2AV opened on Sep 5, 2026

• quic: no coverage for client certificates that are validly signed and must still be refused

  bugseverity:medium
  MDA2AV/ioxide#203 · Filter by author MDA2AV opened on Aug 19, 2026

• quic: the handler cannot read the peer's certificate - no PeerCertificateDer

  enhancementseverity:low
  MDA2AV/ioxide#202 · Filter by author MDA2AV opened on Aug 19, 2026

• quic: trust anchors are fixed at construction, so a rotation cannot change who may connect

  enhancementseverity:medium
  MDA2AV/ioxide#201 · Filter by author MDA2AV opened on Aug 19, 2026

• quic: a client CN carrying control characters is accepted, where TCP refuses it

  bugseverity:medium
  MDA2AV/ioxide#200 · Filter by author MDA2AV opened on Aug 19, 2026

• kestrel: the ASP.NET adapter has no tests, and exposes a fraction of the TLS surface

  enhancementseverity:medium
  MDA2AV/ioxide#196 · Filter by author MDA2AV opened on Aug 18, 2026

• quic: a reactor shutting down frees every connection without telling the peer

  bugseverity:medium
  MDA2AV/ioxide#195 · Filter by author MDA2AV opened on Aug 18, 2026
  1

• config: ServerConfig.Tcp defaults to new(), so a server that never asks for TCP still binds 8080

  enhancementseverity:low
  MDA2AV/ioxide#191 · Filter by author MDA2AV opened on Aug 17, 2026

• quic connection - backpressure with data/control frames

  MDA2AV/ioxide#190 · Filter by author MDA2AV opened on Aug 16, 2026

• QUIC: bind more than one port per server

  MDA2AV/ioxide#189 · Filter by author MDA2AV opened on Aug 16, 2026

• Evaluate deleting QuicClientEngine

  MDA2AV/ioxide#183 · Filter by author MDA2AV opened on Aug 11, 2026

• tests: robustness gaps - global fd asserts on fixed sleeps, no per-test timeout, dead-port assumptions, bind failure kills the suite

  bugseverity:low
  MDA2AV/ioxide#135 · Filter by author MDA2AV opened on Aug 5, 2026
  2

• opt-in perf experiments: NAPI busy-poll (blocked on #101 for min-wait)

  enhancementseverity:low
  MDA2AV/ioxide#103 · Filter by author MDA2AV opened on Jul 2, 2026
  2

• validate ServerConfig at startup (power-of-two sizes) instead of kernel EINVAL

  severity:low
  MDA2AV/ioxide#102 · Filter by author MDA2AV opened on Jul 2, 2026

• observability: per-reactor counters (ENOBUFS, overflows, accepts, sheds, pool hit rate)

  enhancementseverity:low
  MDA2AV/ioxide#101 · Filter by author MDA2AV opened on Jul 2, 2026

• ZeroCopySend is silently ignored in incremental mode

  bugseverity:low
  MDA2AV/ioxide#100 · Filter by author MDA2AV opened on Jul 2, 2026

• register the ring fd (IORING_REGISTER_RING_FDS) to skip per-enter fdget/fdput

  severity:low
  MDA2AV/ioxide#98 · Filter by author MDA2AV opened on Jul 2, 2026