#35919 p2p: avoid orphanage abort at high peer counts

• Prevent node crashes when more than 3,000 peers announce orphan transactions
• Protects nodes running with custom high connection limits on Linux from assertion aborts

Fixes a node assertion crash in `TxOrphanage` when the number of peers announcing orphans exceeds the global latency score limit (default 3,000). The patch floors the per-peer latency share at one during eviction and adjusts the trimming filter to include peers with a DoS score equal to one. It also adds unit test characterization and updates fuzz testing in `txorphanage_sim`.

Problem: When the peer count exceeds 3,000, integer division causes `MaxPeerLatencyScore()` to return zero. Subsequent calls to `LimitOrphans()` fail an assertion in `GetDosScore()`, aborting the node on systems configured with high connection limits.

P2 · bug fix

• P2 because it fixes an assertion abort in P2P message handling that can crash nodes
• Impacts nodes with custom configurations permitting over 3,000 peer connections

Prevents an unhandled node abort caused by division-by-zero assertion failure during orphan trimming. Although reaching 3,000 peers requires non-default high connection configurations on Linux, fixing unhandled aborts in network message processing is critical for node stability under high load.

Membership: Modifies txorphanage.cpp and txorphanage.h to correct peer DoS scoring and orphan eviction in p2p relay.

Factors: security/stability 2, bug 2, performance 0, user value 1, leverage 0

• Ready for review as author incorporated all reviewer suggestions and CI is clean

Clean mergeable state with all CI passing and recent reviewer suggestions implemented.

Author status: Active, addressed all reviewer comments in the latest force push on 2026-09-15

Resolved concerns:

• Heap underflow segfault if only flooring without adjusting the comparison from > 1 to >= 1 (jeanpablojp)
• Fuzz target txorphanage_sim lacked coverage for global latency score below peer count (brunoerg)
• Orphanage documentation incorrectly implied peers at their limits remain protected during eviction (danielabrozzoni)
• Missing SanityCheck call in the peer_dos_limits unit test (danielabrozzoni)

• Strong support after crash reproduction, fuzzing expansion, and doc updates
• Verified by reproducing the crash on master and confirming the fix (jeanpablojp)
• Approved after author expanded fuzz testing to cover the zero-share path (brunoerg)
• Approved after test sanity checks and comment clarifications were added (danielabrozzoni)

Strong consensus with three reviewers approving the fix and tests

Three contributors tested and ACKed the change, and all proposed test and documentation improvements have been integrated.

• jeanpablojp: 'Reproduced the abort on master 128456b62d with three peers against a global limit of 2.'
• brunoerg: 'code review ACK 5f4429c20c5cae0eb59baa867e131cc939e92d5d'
• danielabrozzoni: 'light ACK 5f4429c20c5cae0eb59baa867e131cc939e92d5d'

Objections: none enumerated.

Support:

• jeanpablojp: reproduced the abort on master and verified both parts of the fix are necessary to prevent a crash
• brunoerg: approved code review after proposing fuzz coverage expansion
• danielabrozzoni: reviewed code, confirmed trimming behavior, and suggested test and documentation improvements

Participants: jeanpablojp (support), brunoerg (support), danielabrozzoni (support)

State derived from the lists: substantive support, no open objection (jeanpablojp, brunoerg, danielabrozzoni)

Review verdicts (DrahtBot): 0 (+3)

• Stale ACK: jeanpablojp, brunoerg, danielabrozzoni

23 lines under test/bench/ci.

• src/node/txorphanage.cpp +14/-14
• src/test/orphanage_tests.cpp +17/-0
• src/test/fuzz/txorphan.cpp +3/-3
• src/node/txorphanage.h +2/-2

Fixes an unhandled assertion failure in TxOrphanage that triggers when more than 3,000 peers announce orphans, causing integer division to floor individual latency score allowances to zero. The patch floors per-peer latency shares at one during eviction and adjusts the eviction candidate filter so peers with scores of one can be trimmed. Test updates characterize the regression in unit tests and expand fuzz coverage in txorphanage_sim. Review is active with unanimous support from three reviewers and ready for merge consideration.