fix: bound mnListsCache admission to stop getmnlistd memory DoS

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,6 +2,8 @@
 
 _Provide a general summary of your changes in the Title above_
 
+_Do not manually line wrap text; allow the GitHub UI to dynamically wrap lines._
+
 _Pull requests without a rationale and clear improvement may be closed
 immediately._
 

AGENTS.md

@@ -24,6 +24,37 @@ changes, update the other in the same commit.
   code; reserve them for things that genuinely need explaining (non-obvious
   invariants, workaround rationale, non-local side effects).
 
+## Assertions and Checks
+
+Full guidance lives in `doc/developer-notes.md` under "Assertions and Checks".
+Short version, in order of preference:
+
+- `Assume(cond)` is the default. Use it for "this is how things are supposed to
+  be": a violation means someone has a bug worth investigating, but execution
+  stays well-defined. A negative rate-limit counter is the archetype - somebody
+  decremented twice, we may be more DoS-exposed than intended, but nothing is
+  corrupt. It aborts in `--enable-debug` and `--enable-fuzz` builds (CI's
+  `linux64_multiprocess` and fuzz jobs) while a failure is silent in release,
+  so it must never take down a production node. The expression is always
+  evaluated.
+- `assert(cond)` / `Assert(cond)` is the "we must crash now" case. Use it only
+  when continuing would be undefined behavior, memory corruption, or corrupt
+  persisted/consensus state - aborting has to be the safer outcome. It should
+  be rare and obviously justified, but do use it where it is genuinely needed
+  to document and enforce a precondition that keeps the code below it safe.
+  `Assert` returns its argument: `assert(ptr != nullptr); obj = *ptr;` becomes
+  `obj = *Assert(ptr);`
+- `CHECK_NONFATAL(cond)` / `NONFATAL_UNREACHABLE()` for internal logic bugs on
+  a path with a caller to report to. Required in RPC code, enforced
+  (best-effort) by `test/lint/lint-assertions.py` for `src/rpc/` and
+  `src/wallet/rpc*`.
+
+None of these validate input. Data from peers, RPC arguments, wallet files, or
+on-disk state must be checked and rejected through normal error handling -
+asserting on it turns a peer-triggered inconsistency into a remote crash.
+Environment failures (disk full, corrupt block on disk, failed DB write) are
+not checks at all: return an error, `AbortNode()`, or `InitError()`.
+
 ## Repository Map
 
 - `src/` - C++ implementation.

CLAUDE.md

@@ -24,6 +24,37 @@ changes, update the other in the same commit.
   code; reserve them for things that genuinely need explaining (non-obvious
   invariants, workaround rationale, non-local side effects).
 
+## Assertions and Checks
+
+Full guidance lives in `doc/developer-notes.md` under "Assertions and Checks".
+Short version, in order of preference:
+
+- `Assume(cond)` is the default. Use it for "this is how things are supposed to
+  be": a violation means someone has a bug worth investigating, but execution
+  stays well-defined. A negative rate-limit counter is the archetype - somebody
+  decremented twice, we may be more DoS-exposed than intended, but nothing is
+  corrupt. It aborts in `--enable-debug` and `--enable-fuzz` builds (CI's
+  `linux64_multiprocess` and fuzz jobs) while a failure is silent in release,
+  so it must never take down a production node. The expression is always
+  evaluated.
+- `assert(cond)` / `Assert(cond)` is the "we must crash now" case. Use it only
+  when continuing would be undefined behavior, memory corruption, or corrupt
+  persisted/consensus state - aborting has to be the safer outcome. It should
+  be rare and obviously justified, but do use it where it is genuinely needed
+  to document and enforce a precondition that keeps the code below it safe.
+  `Assert` returns its argument: `assert(ptr != nullptr); obj = *ptr;` becomes
+  `obj = *Assert(ptr);`
+- `CHECK_NONFATAL(cond)` / `NONFATAL_UNREACHABLE()` for internal logic bugs on
+  a path with a caller to report to. Required in RPC code, enforced
+  (best-effort) by `test/lint/lint-assertions.py` for `src/rpc/` and
+  `src/wallet/rpc*`.
+
+None of these validate input. Data from peers, RPC arguments, wallet files, or
+on-disk state must be checked and rejected through normal error handling -
+asserting on it turns a peer-triggered inconsistency into a remote crash.
+Environment failures (disk full, corrupt block on disk, failed DB write) are
+not checks at all: return an error, `AbortNode()`, or `InitError()`.
+
 ## Repository Map
 
 - `src/` - C++ implementation.

ci/dash/lint-cstyle-casts.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Dash Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+"""Support C-style cast linting in Dash-specific C++ code."""
+
+import argparse
+import json
+import re
+import shlex
+import subprocess
+import sys
+from pathlib import Path
+from typing import TextIO
+
+
+CPP_SOURCE_EXTENSIONS = {".cc", ".cpp", ".cxx"}
+DIAGNOSTIC_RE = re.compile(r"^(.*?):\d+:\d+: (?:warning|error): .*")
+MACRO_EXPANSION_RE = re.compile(r"^(.*?):\d+:\d+: note: expanded from macro .*")
+OLD_STYLE_CAST_DIAGNOSTICS = {"clang-diagnostic-old-style-cast", "google-readability-casting"}
+
+
+def get_dash_files(source_root: Path) -> list[str]:
+    manifest = source_root / "test/util/data/non-backported.txt"
+    patterns = [line.strip() for line in manifest.read_text(encoding="utf8").splitlines() if line.strip()]
+    result = subprocess.run(
+        ["git", "ls-files", "--", *patterns],
+        cwd=source_root,
+        check=True,
+        stdout=subprocess.PIPE,
+        text=True,
+        encoding="utf8",
+    )
+    return [line for line in result.stdout.splitlines() if line]
+
+
+def is_dash_file(path: str, dash_files: set[str]) -> bool:
+    normalized = path.replace("\\", "/")
+    return any(normalized == dash_file or normalized.endswith(f"/{dash_file}") for dash_file in dash_files)
+
+
+def prepare_compile_database(source_root: Path, input_path: Path, output_dir: Path) -> None:
+    database = json.loads(input_path.read_text(encoding="utf8"))
+
+    for entry in database:
+        if "arguments" not in entry:
+            entry["arguments"] = shlex.split(entry.pop("command"))
+        entry["arguments"].extend(["-Wold-style-cast", "-Wno-error=old-style-cast"])
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+    (output_dir / "compile_commands.json").write_text(json.dumps(database), encoding="utf8")
+
+
+def filter_diagnostics(source_root: Path, input_stream: TextIO, output_stream: TextIO) -> bool:
+    dash_files = set(get_dash_files(source_root))
+    group: list[str] = []
+    found_violation = False
+
+    def flush() -> None:
+        nonlocal found_violation
+        if not group:
+            return
+        diagnostic_match = DIAGNOSTIC_RE.match(group[0])
+        is_cast_diagnostic = any(diag in group[0] for diag in OLD_STYLE_CAST_DIAGNOSTICS)
+        macro_expansions = [
+            expansion_match
+            for line in group
+            if (expansion_match := MACRO_EXPANSION_RE.match(line))
+        ]
+        target_file = macro_expansions[-1].group(1) if macro_expansions else (diagnostic_match.group(1) if diagnostic_match else "")
+        is_dash_diagnostic = is_dash_file(target_file, dash_files) if target_file else False
+
+        if not is_cast_diagnostic or is_dash_diagnostic:
+            output_stream.writelines(group)
+        found_violation |= is_cast_diagnostic and is_dash_diagnostic
+        group.clear()
+
+    for line in input_stream:
+        if DIAGNOSTIC_RE.match(line):
+            flush()
+            group.append(line)
+        elif group:
+            group.append(line)
+        else:
+            output_stream.write(line)
+    flush()
+    return found_violation
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    prepare = subparsers.add_parser("prepare", help="create a Dash-aware compilation database")
+    prepare.add_argument("--input", type=Path, required=True)
+    prepare.add_argument("--output-dir", type=Path, required=True)
+    prepare.add_argument("--source-root", type=Path, required=True)
+
+    filter_parser = subparsers.add_parser("filter", help="filter clang-tidy diagnostics")
+    filter_parser.add_argument("--source-root", type=Path, required=True)
+
+    args = parser.parse_args()
+    source_root = args.source_root.resolve()
+    if args.command == "prepare":
+        prepare_compile_database(source_root, args.input.resolve(), args.output_dir.resolve())
+        return 0
+    return int(filter_diagnostics(source_root, sys.stdin, sys.stdout))
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ci/dash/lint-tidy.sh

@@ -66,8 +66,20 @@ python3 "${CLANG_TIDY_CACHE_PY}" --zero-stats 2>&1 || true
 
 cd "${BASE_ROOT_DIR}/build-ci/dashcore-${BUILD_TARGET}/src"
 
-if ! ( run-clang-tidy -clang-tidy-binary="${CLANG_TIDY_CACHE}" -quiet "${MAKEJOBS}" | tee tmp.tidy-out.txt ); then
-  grep -C5 "error: " tmp.tidy-out.txt
+CAST_LINT_DB="${PWD}/../cstyle-cast-compile-db"
+python3 "${BASE_ROOT_DIR}/ci/dash/lint-cstyle-casts.py" prepare \
+  --input "${PWD}/../compile_commands.json" \
+  --output-dir "${CAST_LINT_DB}" \
+  --source-root "${BASE_ROOT_DIR}"
+
+if ! ( run-clang-tidy \
+  -checks=clang-diagnostic-old-style-cast,google-readability-casting \
+  -clang-tidy-binary="${CLANG_TIDY_CACHE}" \
+  -p "${CAST_LINT_DB}" \
+  -quiet "${MAKEJOBS}" | \
+  python3 "${BASE_ROOT_DIR}/ci/dash/lint-cstyle-casts.py" filter --source-root "${BASE_ROOT_DIR}" | \
+  tee tmp.tidy-out.txt ); then
+  grep -E -C5 "error: |warning: use of old-style cast|google-readability-casting" tmp.tidy-out.txt
   echo "^^^ ⚠️ Failure generated from clang-tidy"
   false
 fi

ci/dash/matrix.sh

@@ -12,7 +12,7 @@ source ./ci/test/00_setup_env.sh
 
 # Configure sanitizers options
 export ASAN_OPTIONS="detect_leaks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"
-export LSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/lsan"
+export LSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/lsan:print_suppressions=0"
 export TSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1:second_deadlock_stack=1"
 export UBSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1"
 

ci/dash/test_integrationtests.sh

@@ -28,6 +28,11 @@ fi
 
 cd "build-ci/dashcore-$BUILD_TARGET"
 
+if [ -n "${CI_LIMIT_STACK_SIZE}" ]; then
+  # Upstream uses 512, which segfaults dashd during test framework startup.
+  ulimit -s 1024
+fi
+
 if [ "$SOCKETEVENTS" = "" ]; then
   # Let's switch socketevents mode to some random mode
   R=$((RANDOM%3))

ci/test/00_setup_env_native_asan.sh

@@ -7,12 +7,13 @@
 export LC_ALL=C.UTF-8
 
 export CONTAINER_NAME=ci_native_asan
-export PACKAGES="clang-19 llvm-19 libclang-rt-19-dev python3-zmq qtbase5-dev qttools5-dev-tools libevent-dev bsdmainutils libboost-dev libdb5.3++-dev libminiupnpc-dev libzmq3-dev libqrencode-dev"
+export PACKAGES="clang-19 llvm-19 libclang-rt-19-dev python3-zmq qtbase5-dev qttools5-dev-tools libevent-dev bsdmainutils libboost-dev libminiupnpc-dev libzmq3-dev libqrencode-dev"
 # Reuses the depends built for the linux64 target, which uses the defaults.
 export DEP_OPTS=""
-export TEST_RUNNER_EXTRA="--timeout-factor=4 -j2"  # Increase timeout because sanitizers slow down
+export TEST_RUNNER_EXTRA="--timeout-factor=4 -j4"  # Increase timeout because sanitizers slow down
+export CI_LIMIT_STACK_SIZE=1
 export GOAL="install"
-export BITCOIN_CONFIG="--enable-zmq --enable-crash-hooks --with-gui=qt5 \
+export BITCOIN_CONFIG="--enable-zmq --enable-crash-hooks --with-gui=qt5 --without-bdb --with-sqlite \
 --with-sanitizers=address,float-divide-by-zero,integer,undefined \
 CPPFLAGS='-DARENA_DEBUG -DDEBUG_LOCKORDER' \
 CC='clang-19 -ftrivial-auto-var-init=pattern' CXX='clang++-19 -ftrivial-auto-var-init=pattern'"

ci/test/04_install.sh

@@ -15,7 +15,7 @@ mkdir -p "${CCACHE_DIR}"
 mkdir -p "${PREVIOUS_RELEASES_DIR}"
 
 export ASAN_OPTIONS="detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"
-export LSAN_OPTIONS="suppressions=${BASE_BUILD_DIR}/test/sanitizer_suppressions/lsan"
+export LSAN_OPTIONS="suppressions=${BASE_BUILD_DIR}/test/sanitizer_suppressions/lsan:print_suppressions=0"
 export TSAN_OPTIONS="suppressions=${BASE_BUILD_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1"
 export UBSAN_OPTIONS="suppressions=${BASE_BUILD_DIR}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1"
 env | grep -E '^(BASE_|QEMU_|CCACHE_|LC_ALL|BOOST_TEST_RANDOM|DEBIAN_FRONTEND|CONFIG_SHELL|(ASAN|LSAN|TSAN|UBSAN)_OPTIONS|PREVIOUS_RELEASES_DIR))' | tee /tmp/env

configure.ac

@@ -2077,7 +2077,9 @@ CPPFLAGS="$CPPFLAGS_TEMP"
 if test -n "$use_sanitizers"; then
   export SECP_CFLAGS="$SECP_CFLAGS $SANITIZER_CFLAGS"
 fi
-ac_configure_args="${ac_configure_args} --disable-shared --with-pic --enable-benchmark=no --enable-module-recovery --disable-module-ecdh --disable-openssl-tests"
+dnl The ECDH module is required by the wallet's Platform key provider
+dnl (DashPay contact request encryption, wallet/platformkeys.cpp).
+ac_configure_args="${ac_configure_args} --disable-shared --with-pic --enable-benchmark=no --enable-module-recovery --enable-module-ecdh --disable-openssl-tests"
 AC_CONFIG_SUBDIRS([src/dashbls src/secp256k1])
 
 AC_OUTPUT

contrib/devtools/circular-dependencies.py

@@ -11,6 +11,10 @@
 MAPPING = {
     'core_read.cpp': 'core_io.cpp',
     'core_write.cpp': 'core_io.cpp',
+    'evo/core_write.cpp': 'core_io.cpp',
+    'evo/providertx_util.cpp': 'evo/providertx.cpp',
+    'llmq/core_write.cpp': 'core_io.cpp',
+    'qt/guiutil_font.cpp': 'qt/guiutil.cpp',
 }
 
 # Directories with header-based modules, where the assumption that .cpp files