F15-YG: No

Rationale

The selected TCP/TLS listener starts a goroutine for every accepted connection and installs per-connection link state before the metadata handshake and peer-key admission. Metadata decoding verifies a signature and then the handler checks pinned keys or the incoming-key allowlist before HandleConn. However, this listener path has no aggregate cap on concurrent pre-admission handlers or link entries. Its six-second I/O deadline and 16-bit metadata length bound each exchange, not the number of simultaneous attempts. The examined composition therefore lacks the combined admission and aggregate pending-state/work bound required for this F15 verdict.

Assessment method

Primary documentation and pinned source review; no runtime experiment

Source context

Pinned Yggdrasil listener, metadata admission and TLS link

Outstanding qualification

This does not deny peer authorization: failed metadata/key admission prevents entry into Ironwood routing and failed connections are closed and removed. Incoming allowlist enforcement is conditional and excludes local links; an empty allowlist is permissive. Signature generation, TLS, parsing, signature verification and connection bookkeeping already cost resources. The deadline is cleared before key-policy checks and is not a whole-handler CPU budget. Remote address/port changes can create distinct link entries; duplicate-link suppression is not a global admission quota. No external firewall, proxy connection limiter or new kernel policy is added. This is a source-level negative for the selected path, not a demonstrated outage, a measured attack threshold or a claim about every Yggdrasil deployment.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.

round545.html
round545-sources.json