fix: the kcp transport layer's waitfordatainput() fu... in connection.go

[orbisai0security]

Summary

Fix high severity security issue in transport/internet/kcp/connection.go.

Vulnerability

Field	Value
ID	V-003
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-003
File	transport/internet/kcp/connection.go:275

Description: The KCP transport layer's waitForDataInput() function blocks indefinitely waiting for data to arrive on a connection. No read deadline or idle timeout is applied. An attacker can open a large number of KCP connections, complete the initial handshake to pass any connection-level checks, and then send no data. Each such connection holds a goroutine permanently blocked in waitForDataInput(), consuming memory and goroutine stack space until the server is exhausted.

Changes

• transport/internet/kcp/connection.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security