[quinnj]

Five low-impact fixes from a sixth review pass. None affects HTTP.jl 1.x's default use; two are regressions from this week's unreleased PRs.

• isreadable(ctx) stole a waiting reader's data. It decrypted arriving records even while another task waited in eof(ctx) for them, leaving that task waiting on an empty socket with the data already decrypted. With renegotiation on (Don't let a write wait forever after a read finishes the renegotiation #323), it blocked behind the reader instead. It now processes records only when it can take waitlock; a waiting reader processes them itself.
• Parsing a key into a filled PKContext destroyed the old key. mbedtls parses only into an empty context; given one that holds a key, it frees that key and fails with "Bad input parameters". Configs using the key then failed every handshake, and RSA(pk) views read freed memory. parse_key!, parse_public_key!, parse_keyfile! and parse_public_keyfile! now throw an ArgumentError first.
• A failed re-seed broke a working generator (regression from Re-seed a CtrDrbg in a fresh context; keep raw add_source! objects alive #322). seed! freed the context before seeding, so bad pdata or a failing entropy source left the generator unusable, and every config using it failed handshakes. It now seeds a fresh context and swaps it in only on success.
• show(MbedTLS.CRT()) ran out of memory (regression from Fix ALPN lifetime, get_peer_cert, long cert info, and byte reads #302). For a CRT with no certificate, mbedtls reports "buffer too small" about its own internal buffer, and the growth loop doubled forever. Growth now stops at 16 MiB and the error is thrown.
• set_alpn!(conf, String[]) made mbedtls send an empty ALPN extension, which RFC 7301 forbids and OpenSSL servers reject. It now throws an ArgumentError.

Also: the ssl_unsafe_read docstring now says it can wait for another task's read or write when renegotiation is on.

Each has a test; they fail on master. Passes on Julia 1.12, 1.10 and nightly locally.

Found by a sixth independent review pass; reproduced and checked here.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.96%. Comparing base (fa3aa4e) to head (8571392).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #324      +/-   ##
==========================================
+ Coverage   89.82%   89.96%   +0.14%     
==========================================
  Files          12       12              
  Lines         924      937      +13     
==========================================
+ Hits          830      843      +13     
  Misses         94       94              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.