[go-LIN-06] Oversize payloads are silently accepted instead of returning ErrPayloadTooLarge

[SoundMatt]

Location

adapt.go (linNode.Send); virtual/bus.go (Bus.Publish).

Finding

The RELAY specification requires a Node.Send implementation to return the ErrPayloadTooLarge sentinel when a caller hands it a payload larger than the protocol allows. linNode.Send only validates that the frame ID parses and is in range before forwarding straight to bus.Publish; virtual.Bus.Publish never compares len(data) against LINMaxDataLen. A payload well beyond the 8-byte LIN frame maximum is accepted without error at registration time, and only fails later (if at all) when something else tries to validate the frame. The ErrPayloadTooLarge sentinel is defined in lin.go but nothing on this send path ever returns it. I confirmed at current HEAD that linNode.Send still has no length check and virtual.Bus.Publish still has no length check either.

Recommendation

Add a len(data) > LINMaxDataLen check that returns ErrPayloadTooLarge, in both virtual.Bus.Publish and linNode.Send, so oversize payloads are rejected as the spec requires rather than silently accepted.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.