CodeQL flagged these in wolfssh/src/internal.c:

CWE-191: Unsigned subtraction can never be negative.

This rule finds relational comparisons between the result of an unsigned subtraction and the value 0. Such comparisons are likely to be wrong as the value of an unsigned subtraction can never be negative. So the relational comparison ends up checking whether the result of the subtraction is equal to 0. This is probably not what the programmer intended.

libs/wolfssh/src/internal.c:3230

   3228     }
   3229 
   3230     while (ssh->outputBuffer.length - ssh->outputBuffer.idx > 0) {
   3231         int sent;
   3232 

libs/wolfssh/src/internal.c:10005

  10003 
  10004                 if (!aeadMode) {
  10005                     if (ssh->curSz + UINT32_SZ - peerBlockSz > 0) {
  10006                         ret = Decrypt(ssh,
  10007                                 ssh->inputBuffer.buffer + ssh->inputBuffer.idx

https://cwe.mitre.org/data/definitions/191.html