[Critical] RC Server dispatch path never enforces replay/watchdog/E2E safety checks — SG-003 unqualified

[SoundMatt]

What's wrong

mock::RcServer::handle_abb / handle_ntscf_frame are the crate's only live RC Server dispatch path (src/mock.rs, lines ~326-379), and udp::UdpRcServer reuses this same function unchanged (src/udp.rs:457). The dispatch logic is exactly:

route_byte_bus_id -> EndpointTable::lookup -> Endpoint::read/write

None of the crate's safety/security enforcement functions are ever called from this path:

• evaluate_rx_enforce_seq (replay-sequence check) — only called from its own unit tests in src/request.rs, never from mock.rs.
• Watchdog overflow purge — no reference in src/mock.rs.
• check_rx_enforce_e2e / crc32_tc18 (E2E/CRC integrity check) — no reference in src/mock.rs.

grep -c for watchdog|e2e|check_rx_enforce_e2e|crc32_tc18 in src/mock.rs returns 0 matches.

Why it matters

This means replayed requests, watchdog-overflowed requests, and CRC-corrupted safety-critical requests are all accepted and executed identically to normal, valid requests — on the crate's only working server implementation. .fusa-hara.json's H-003/SG-003 entries (ASIL-B, 500ms FTTI, replay detection) carry no qualifier of any kind on the JSON record marking this gap, so the machine-readable HARA claims an enforced safety goal that isn't actually wired to the live dispatch path. (tara.json asset A-002 and risk T-RCP-03's residualRisk field do independently acknowledge "no rust-RCP-internal replay protection is currently enforced end-to-end," and HARA.md's prose has a footnote pointing at that caveat — so this isn't wholly undocumented, but the JSON HARA record itself is unqualified, which is what safety tooling/audits would actually consume.)

Suggested fix

Wire evaluate_rx_enforce_seq, the watchdog overflow purge, and check_rx_enforce_e2e/crc32_tc18 into handle_abb/handle_ntscf_frame before dispatch to Endpoint::read/write, rejecting requests that fail these checks. Alternatively, if this is deliberately deferred, add an explicit qualifier to the SG-003 entry in .fusa-hara.json itself (not just prose docs) so automated HARA consumers see the caveat.

---

Filed from the RELAY ecosystem audit (2026-07-29), category: bug, severity: critical.