In the WOLF_CRYPTO_CB_ONLY_ECC path of wolfSSL_ECDSA_do_verify, a
non-positive length from i2d_ECDSA_SIG (an encoding failure) skipped
the verify block and left ret at its initial value of 1, reporting a
valid signature although no verification was performed. Map the
encoding failure to WOLFSSL_FATAL_ERROR so it is not treated as a
successful verification.

Fixes F-6981.

VerifyX509Acert parsed the acert and checked the signature but never
validated the notBefore and notAfter dates, so wolfSSL_X509_ACERT_verify
and wc_VerifyX509Acert accepted expired or not-yet-valid attribute
certificates whenever the signature was good. Call CheckDate for both
validity bounds before signature verification. CheckDate returns the
proper date error and honors the runtime skip-date control. Also correct
ParseX509Acert to report ASN_AFTER_DATE_E instead of ASN_BEFORE_DATE_E
when the notAfter date check fails.

Fixes F-6986.

The sniffer elided all session, server, and keylog secret list locking
whenever HAVE_C___ATOMIC was defined, assuming those tables are
thread-local and need no mutex. Thread-locality is actually governed by
THREAD_LS_T, which is only a real qualifier when HAVE_THREAD_LS is set
and NO_THREAD_LS is not. A build with HAVE_C___ATOMIC and NO_THREAD_LS
left the tables as process-shared globals with no synchronization, so
concurrent packet processing raced on the list pointers and could free a
session another thread was still using. Gate the lock elision on both the
atomic fast path and real thread-local storage, and take the mutexes
whenever the tables are process-shared. The stats counter path is
unchanged because it uses a genuine atomic add.

Fixes F-6983.

InitSuitesHashSigAlgo added the ecdsa_sha1 and rsa_pkcs1_sha1 signature
schemes to the signature_algorithms list based only on the build flags,
ignoring the negotiated protocol version. Because that list is also the
set a peer's signatures are validated against, any build with old TLS
compiled in advertised and accepted SHA-1 handshake and certificate
signatures for TLS 1.2, which RFC 9155 deprecates. Gate the SHA-1 schemes
on the negotiated version so they are offered only for TLS 1.0 and 1.1
handshakes, unless WOLFSSL_ALLOW_TLS_SHA1 is defined to opt back in. The
same gate excludes them for TLS 1.3, as required by RFC 8446.

Fixes F-6991.

The SecureRenegotiation extension embeds a Keys tmp_keys copy of the
session cipher and MAC keys, which are the keys used for the renegotiated
epoch. SCR_FREE_ALL freed that struct with a bare XFREE, leaving a full
set of session keys intact in freed heap memory. Wipe the struct with
ForceZero before freeing it, matching the ForceZero of ssl->keys on
connection teardown.

Fixes F-7008.

WOLFSSL_ALPN_CONTINUE_ON_MISMATCH makes a server continue the handshake
without an agreed protocol when no ALPN protocol matches, like OpenSSL,
instead of sending the fatal no_application_protocol alert that RFC 7301
section 3.2 requires. This is an explicit, caller-selected opt-in:
wolfSSL_UseALPN rejects a call that sets neither mismatch option, and the
library never enables it implicitly. Document the RFC non-compliance at
the option enum, the wolfSSL_UseALPN options parameter, and the mismatch
handling in ALPN_find_match so the trade-off is clear at every point a
user or maintainer encounters it. No behavior change.

Fixes F-7003.

RFC 9147 section 5.6.1 states that EndOfEarlyData is not used in DTLS 1.3
and that a receiver must terminate the connection with an
unexpected_message alert. Dtls13CheckEpoch grouped end_of_early_data into
the default case that returns SANITY_MSG_E without sending any alert, and
the DTLS 1.3 handshake dispatch in DoProcessReplyEx did not send a fatal
alert on error the way the DTLS 1.2 path does, so the connection was
dropped silently. Add an explicit end_of_early_data case that sends the
unexpected_message alert, and mirror the DTLS 1.2 SendFatalAlertOnly
handling in the DTLS 1.3 dispatch so other handshake errors are also
reported rather than dropped silently.

Fixes F-6987.