…(P3)

Phase 3 of roadmap/plan-graceful-shutdown.md (Pattern D' on the
`roadmap` branch).  Audits the five upstream TODO/FIXME sites
flagged for the "silent fall-through on write paths" bug family
and applies PR nginx#54's contract where it matters.  Of the five,
two are real NULL-deref bugs that needed code fixes; three are
documentation-only dispositions.

Real fixes
----------

src/nxt_port_socket.c:746  nxt_port_read_handler
  The empty `if (b == NULL) {}` body fell through to
  `iov[1].iov_base = b->mem.pos`, NULL-derefing on transient OOM
  in the port mem_pool.  Now alerts, disarms the read event via
  nxt_fd_event_block_read, and `goto fail` (the existing fail:
  label at :802 queues nxt_port_error_handler).  Strict
  improvement: crash -> orderly teardown.  Recovery via
  timer-driven retry was rejected as out of P3 scope.

src/nxt_port_socket.c:889  nxt_port_queue_read_handler
  Same NULL-deref class -- `b->mem.pos` was used in both the
  dequeue memcpy and the iov[1] recv branch.  Mirror the fix:
  alert, disarm, decrement queue->nitems (balances the entry
  +1 at :830), and queue nxt_port_error_handler.

Both sites now carry an `nxt_assert(b != NULL)` immediately past
the OOM-teardown block, documenting the invariant for future
audits and providing a deterministic guard against a future
regression that re-introduces an empty if-body.

Documentation-only dispositions
-------------------------------

src/nxt_port_socket.c:1369  nxt_port_error_handler
  The bare `/* TODO */` historically asked for richer error
  context (e.g. surfacing socket.error to peers).  Audit found
  the handler already drains queued sends, releases buffers,
  and decrements port refcounts -- no silent-success or
  NULL-deref bug hidden here.  Replaced bare TODO with a
  disposition note; richer error responses are a future
  enhancement and not part of PR nginx#54's write-path contract.

src/nxt_router.c:5895,5917  nxt_router_get_mmap_handler
  Two `// FIXME` markers on best-effort RPC_ERROR sends.  The
  function is `void`, delivery failures surface in
  port->socket.error and the port-side teardown
  (nxt_port_error_handler) fires; peer-side RPC timeout is the
  ultimate backstop.  Replaced FIXMEs with a one-line
  disposition note and added explicit `(void)` casts to match
  the convention at the end of the same function.

Tests
-----

No new tests.  The NULL-deref sites cannot be reliably
reproduced from Python without malloc-failure injection
(LD_PRELOAD or AddressSanitizer with allocator hooks); ASan
validation is recommended in CI follow-up.  The
nxt_assert(b != NULL) lines provide deterministic in-tree
documentation of the invariant in lieu of a behavioural test.

Verified
--------

  ./configure --tests --modules=python && ./configure python \
    --config=python3-config && make -j$(nproc)              # clean
  python3 -m pytest test/test_idle_close_wait.py            # 2 pass
  python3 -m pytest test/test_python_application.py         # 40 pass, 6 skip

Refs
----
- roadmap/plan-graceful-shutdown.md P3 (Pattern D')
- PR nginx#54 (TLS write-path contract; the canonical shape mirrored
  by the two real fixes above)