const LAN_PEER_STALE_TIMEOUT_CEIL_SECS: u64 = 9000;Expand description
Ceiling on other_ttl_secs-driven staleness (ReAgent P1, PR #3301):
other_ttl_secs is taken directly from a peer’s own mDNS advertisement,
which this file already treats as adversarial elsewhere (see
LAN_AGENT_NAMES_MAX_* above — “anything that can fake an mDNS
advertisement… makes it into self.instances”). Without a cap, a
spoofed peer advertising other_ttl near u32::MAX (~136 years) would be
honored by both get_instances() and the periodic GC, permanently pinning
it as “alive” — defeating the entire self-pruning design this exists for.
2x the RFC 6762 §10 / mdns-sd 0.12 default (4500s) comfortably covers every
legitimate cadence actually observed on this LAN (narko/starpower’s ~46min
gaps) with margin, while bounding attacker-controlled input the same way
the byte/count/length caps above already do.