F15-GN: Yes
Rationale
In the selected GNUnet 0.20.0 legacy UDP composition, reassembly retains at most 128 sender-address contexts with three message contexts each, evicting old contexts when limits are reached. Message length is represented by a 16-bit field and checked before allocation. CORE rejects data unless its key exchange is established, checks the HMAC before payload decryption, and rejects duplicate/old messages before service dispatch. These native mechanisms combine bounded unauthenticated reassembly state with cryptographic admission to downstream processing.
Assessment method
Primary documentation and pinned source review; no runtime experiment
Source context
GNUnet 0.20.0 UDP defragmentation limits and CORE authentication gate
Outstanding qualification
The limits describe retained reassembly state, not an exact process-memory ceiling: allocation precedes eviction, so temporary extra contexts exist. Fragment handling, acknowledgments, session/key-exchange work, HMAC verification, logging and other queues remain outside this bound. CORE authentication identifies a cryptographic neighbor; it is not a final CADET application allowlist. An admitted neighbor can generate valid traffic, and changing sender addresses can evict legitimate partial messages. No fairness, service-floor or CPU-rate guarantee is asserted. Keep legacy UDP and the pinned release; no TNG, external limiter, complete deployment test or final-receiver policy is imported.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round550.html
- round550-sources.json