NET/TCP/UDP/CURL-integration batch (2026-07-07 review). NETInfo reports OK without ever copying the resolved host into the output buffer; the aNETAddress macro memcpys past a stack pad on long hosts; the bind walk aborts on the first EADDRNOTAVAIL instead of trying the next address. CURL's event-loop glue can stall transfers. Most of this is unreachable by tests today because WITH_INET is never on in CI (ABC-017).
NET.h:40-54 NETInfo — getnameinfo writes stack locals host/
service; Bu8rewind(text, range) only moves boundary pointers, no memcpy into text ever happens → OK with stale/zero payload. Uncalled in-tree (hence unnoticed); exported API.
NET.h:29-38 aNETAddress — Bu8rewind return ignored; the twomemcpys run unconditionally → stack OOB write for host ≥ 254 bytes, misplaced port on smaller failures. Hand-assembled pad vs typed feeds.
NET.c:12 — a_pad(u8, host, 64) vs NETmaxhost 222 / DNS max 253:legal hostnames > 63 chars make Resolve/Connect/Listen fail SNOROOM.
TCP.c:50-56 + UDP.c:19-25 — first bind() failure returns TCPFAIL
instead of trying the next addrinfo (dual-stack v6-first breaks v4); dead if (rc == 0) break; betrays the mangled loop.
TCP.c:9 — TCPConnect(..., b8 nonblocking) param silently ignored(INDEX.md advertises it); POL callers get a blocking connect.
TCP.h:12-18 TCPAccept — accept's addrlen discarded, no
Bu8rewind(addr, ...) (cf. UDP.h:25) → NETraw(addr) stays empty; no EINTR retry; EAGAIN == hard TCPFAIL. UDP.h:20-36: same EINTR/EAGAIN collapse + no MSG_TRUNC check (silent datagram truncation).
TCP.c:64 TCPListen — no SO_REUSEADDR: EADDRINUSE for the wholeTIME_WAIT window on restart.
CURL.c:26-38 — write/header callbacks ignore u8bReserve/u8bFeed
failures and return bytes → on OOM, truncated body delivered with HTTP 200. Return 0/CURL_WRITEFUNC_ERROR instead.
CURL.c:44-59 curl_pol_cb — returns the PRE-action events mask,
clobbering interest changes curl made during socket_action → stalls on IN→OUT transitions. CURL.c:77 POLTrackEvents return dropped.
CURL.c:8-9,83 — process-global curl_multi/curl_running/timer vsPOL's thread_local queue: cross-thread use silently corrupts.
POL.c:34 — pollerbAllocate return unchecked in POLInit; POL.c:301
int pollms overflows for multi-week deadlines → negative timeout → poll blocks forever.
CURL callbacks). Fix per item; EINTR/EAGAIN policy consistent with FILE.c's retry convention.
ticket touches the callbacks/event glue only.