Reject oversized BAP UART frames

[Distortions81]

Summary

• Centralize complete BAP frame and checksum formatting.
• Reject negative or truncated formatting results before either UART path uses the length.
• Queue only validated complete frames.
• Handle UART return lengths without signed/unsigned confusion.
• Test exact-fit, overflow, invalid arguments, and undersized buffers.

Root cause and impact

snprintf() truncated safely but returned the length that would have been written. The immediate path passed that larger length to uart_write_bytes(), allowing a bounded stack over-read; the queued path produced a malformed truncated frame.

Valid BAP frames are unchanged and oversized frames are dropped. No authentication or access-control behavior is added.

Related work

#1525 improved the BAP implementation; this draft hardens its existing UART formatting and queue paths without changing the protocol.

CI follow-up

The first run resolved a new test component relative to symlinked test-ci/ incorrectly. ../test/components now works from both local test/ and CI.

Validation

• Host ASan/UBSan boundary checks passed
• ESP-IDF 6.0.2 firmware and ESP32-S3 test builds passed
• Exact CI QEMU environment: 76 passed, 0 failed
• All four BAP tests confirmed executed
• git diff --check

A real UART/BAP peer smoke test remains desirable.

[github-actions]

Test Results

  2 files    2 suites   0s ⏱️
124 tests 124 ✅ 0 💤 0 ❌
126 runs  126 ✅ 0 💤 0 ❌

Results for commit e726145.