# Specification: Full Review — Test Coverage Gaps

**Track ID:** review-tests_20260318
**Type:** Chore
**Created:** 2026-03-18
**Status:** Draft

## Summary

Fill critical test coverage gaps identified in the comprehensive code review: adversarial mDNS parser tests, DoS resilience tests for the UDP transport queue, discovery source ID rejection validation, and protocol correctness assertions for the MultiZone device.

## Context

Despite 2425+ tests, the review identified 4 High-severity coverage gaps in security-relevant and correctness-critical paths (with additional acceptance criteria for related sub-cases like `get_color_zones()` state updates). The mDNS DNS parser handles fully attacker-controlled network data but has no adversarial input tests. The unbounded UDP transport queue has no flood resilience test. Discovery source ID validation is untested with spoofed packets. The MultiZone direction setter bug (creating a 9-element list instead of 8) has no test that would have caught it.

## Acceptance Criteria

- [ ] Adversarial mDNS DNS parser test suite covers: inflated record counts, oversized `rdlength`, deeply nested compression pointer chains, malformed UTF-8 labels in DNS names
- [ ] UDP transport queue test verifies bounded behavior (drop-on-full after review-critical_20260318 `maxsize=1000` fix lands) or documents current unbounded behavior
- [ ] Discovery source ID rejection test verifies that responses with wrong source ID are not returned as discovered devices
- [ ] `MultiZoneEffect.direction` setter test asserts `len(parameters) == 8` exactly
- [ ] `get_color_zones()` state update test verifies state updated exactly once per call
- [ ] All new tests follow TDD pattern: written before (or alongside) any fix that addresses the gap
- [ ] All quality gates pass

## Dependencies

- review-critical_20260318 — some tests (UDP queue bound, multizone fixes) test behavior that is being changed in that track; coordinate so tests are written first (TDD)

## Out of Scope

- Performance benchmark tests (→ review-perf_20260318, Phase 1)
- Documentation tests / link checking
- E2E hardware tests
- Effect frame visual correctness tests (T-M3 — lower priority, deferred to backlog)

## Technical Notes

### mDNS adversarial tests (T-H2, SEC-M2)

The DNS parser at `src/lifx/network/mdns/dns.py` parses data received over multicast UDP from any device on the LAN. Tests should cover:

1. **Inflated record count**: Header says 65535 answers but data is only 12 bytes → must raise `ValueError`
2. **Oversized rdlength**: Resource record claims `rdlength=65535` but only 4 bytes of rdata follow → must raise `ValueError`
3. **Compression pointer at max depth**: Chain of exactly 10 pointers (should succeed); chain of 11 (should raise)
4. **Circular compression pointer**: Pointer pointing to itself → should raise within `max_jumps` limit
5. **Malformed UTF-8 in label**: Label bytes containing invalid UTF-8 → should handle gracefully (no crash, uses `errors='replace'`)
6. **Empty packet**: 0-byte data → should raise `ValueError`
7. **Truncated header**: Less than 12 bytes → should raise `ValueError`

### Discovery source ID rejection (T-H3)

`discover_devices()` validates that response source IDs match the request source. No test currently sends a crafted packet with a wrong source ID and verifies it is ignored. This requires injecting a packet into the transport queue with a mismatched source ID alongside legitimate emulator responses.

### UDP queue bound test (T-H1)

After review-critical_20260318 adds `maxsize=1000`, test that:
1. Sending 1001 packets to `datagram_received` results in exactly 1000 items in the queue (the 1001st is dropped)
2. No exception is raised on overflow

Before the fix lands, write a test that documents the current unbounded behavior (as a known issue marker).

---

_Generated by Conductor. Review and edit as needed._
