Fix path challenge and removal logic

[guhetier]

Description

Fixes a kernel-mode PAGE_FAULT crash (KeBugCheckEx) where Connection->PathsCount reaches 0 and a reverse loop for (uint8_t i = PathsCount - 1; ...) underflows to 255, causing an out-of-bounds read on Connection->Paths[255].

The results of a combination of issues, largely tied to the invalid assumption that the path at index 0 in the path array is always valid.

Root cause: This is a combination of multiple issues:

• QuicLossDetectionRetransmitFrames was used as a way to detect PATH_CHALLENGE failures and would remove a path, but would not validate any whether the removed path was the last one.
• QuicConnGetPathForPacket would always create a path for incoming packets at index 1 of the path array, even if the path at index 0 has been removed.
• QuicPathRemove would happily "remove" the same path multiple times

This allows the following scenario:

• A path challenge is sent on path 0
• The path challenge times out
• A PTO causes the retransmission of the path challenge -> QuicLossDetectionRetransmitFrames -> Path 0 is removed (nbPath = 0)
• ACKs are received over a new path 1
  • A Path 1 is created at index 1 in the array (nbPath = 1, first problem, nbPath does match the index actually used)
  • Loss detection triggers QuicLossDetectionRetransmitFrames -> Path 0 is "removed" again, nbPath = 0

Also fixes #5505: paths were not removed when the peer ACKed a PATH_CHALLENGE but never sent a PATH_RESPONSE, because path validation timeout was driven by loss detection retransmission rather than a wall-clock timer. If the challenge frame was ACKed, loss detection considered it delivered and never retransmitted, so the timeout never fired.

Commits

1. Replace loss-detection path validation with wall-clock timer: Adds a dedicated QUIC_CONN_TIMER_PATH_VALIDATION timer instead of attempting to use loss detection retransmission as a proxy.

2. Enforce close-if-last and active-path-fallback invariants in QuicPathRemove QuicPathRemove now handles fallbacks to others paths. When an attempt is made to remove the last path, QuicPathRemove now shutdowns the connection and keeps the last path as a placeholder for every operation assuming a path is present.

3. Use signed int for reverse path loops to prevent underflow Changes uint8_t loop indices to int in all backward-iterating path loops. When PathsCount == 0, PathsCount - 1 evaluates to -1 via integer promotion, making the loop condition immediately false.

4. Add structured ETW events for path lifecycle operations Replaces five QuicTraceLogConnInfo string traces with typed QuicTraceEvent ETW events, so further path-related issues can be diagnosed with low-volume events only.

Testing

CI

Documentation

No documentation impact.

[codecov]

Codecov Report

❌ Patch coverage is 89.28571% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.55%. Comparing base (27e7f9f) to head (2717754).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
src/core/connection.c	90.74%	5 Missing ⚠️
src/core/path.c	85.71%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6020      +/-   ##
==========================================
- Coverage   85.95%   85.55%   -0.41%     
==========================================
  Files          60       60              
  Lines       18792    18835      +43     
==========================================
- Hits        16153    16114      -39     
- Misses       2639     2721      +82     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.