fix(mesh): harden MemoryPool<T,MaxSize>::release() against bad pointers

[ndoo]

Problem

MemoryPool<T,MaxSize>::release() (src/mesh/MemoryPool.h) computed int index = p - pool; — pointer subtraction that's undefined behavior unless p already points into pool. A double-free hit assert(used[index]), which hangs forever with no diagnostic on STM32WL (__wrap___assert_func is while(true);).

This static pool backs clientNotificationPool/staticQueueStatusPool/staticMqttClientProxyMessagePool on every platform including STM32WL (unlike packetPool, which is MemoryDynamic-backed there) — so this is reachable, not theoretical.

Fix

Validate via address arithmetic (reinterpret_cast<uintptr_t>) instead of raw pointer subtraction, rejecting a foreign/misaligned pointer before it's used as an index. Convert the double-free assert() into a logged, graceful return — matching the MemoryDynamic::alloc() precedent from #11197.

Test plan

• pio run -e wio-e5 / pio run -e rak3172 — build clean.
• Hardware (wio-e5): temporarily patched in a one-shot test (not part of this diff) that allocates a meshtastic_ClientNotification, releases it, then deliberately releases the same pointer again and a misaligned pointer. Confirmed over serial: "Double release of pool item 0 at 0x..." and "Pointer 0x... not from our pool!" logged, no hang, boot continues normally (radio init succeeds). Test hook reverted before opening this PR.
• Hardware (wio-e5): reflashed the clean committed fix afterward, confirmed normal boot/operation.

🤝 Attestations

• I have tested that my proposed changes behave as described.
• I have tested that my proposed changes do not cause any obvious regressions on the following devices:
  • Heltec (Lora32) V3
  • LilyGo T-Deck
  • LilyGo T-Beam
  • RAK WisBlock 4631
  • Seeed Studio T-1000E tracker card
  • Other (please specify below): wio-e5 — build + hardware verified per test plan above. rak3172 build-verified only.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 21305c1e-8162-4406-8733-1cd245afe049

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚡ Try this PR in the Web Flasher

Note

Building this pull request… the flash button, badges and supported-board
list will appear here automatically once CI finishes.

[ndoo]

Closing — this is fully superseded by @t-miura's #11223, which landed the same MemoryPool<T,MaxSize>::release() alignment/bounds validation and double-free detection (opened before this one). Thanks for getting to it first!