When "flood_max_unscoped" and "flood_max_advert" were inserted at offsets
291-292 in a previous commit, they displaced "fan_mode" and "fan_timeout_secs"
from their established positions. On upgrade, devices with existing saved
prefs would load the old "fan_mode" byte (0, 1, or 2) into "flood_max_unscoped"
and the low byte of "fan_timeout_secs" into "flood_max_advert", both yielding
values of 0 or 1. A "flood_max_unscoped" or "flood_max_advert" of 0 or 1
effectively silences the repeater, causing it to drop nearly all unscoped
flood and advert packets. Additionally, "rx_boosted_gain" was displaced to
offset 291 in the new layout, causing it to read 0 (gain disabled) on devices
whose prefs were saved before the layout change.
Restore a correct, upgrade-safe layout:
290: reserved_290 (placeholder; preserves the byte that held
rx_boosted_gain in the layout before this series)
291: rx_boosted_gain
292: fan_mode
293-294: fan_timeout_secs (uint16_t)
295: flood_max_unscoped
296: flood_max_advert
"flood_max_unscoped" and "flood_max_advert" are moved to the end so that
existing saved prefs with "fan_mode"/"fan_timeout_secs" at 291-294 are
read correctly on upgrade, and the repeater resumes normal flood forwarding
behaviour.
Also fix a copy-paste bug in loadPrefsInt where the availability
checks for "flood_max_unscoped" and "flood_max_advert" both used
sizeof(rx_boosted_gain) instead of their own field sizes.
When RADIOLIB_STATIC_ONLY=1 is set, RadioLib's SPItransferStream()
allocates two fixed-size stack buffers (buffOut and buffIn) of
RADIOLIB_STATIC_ARRAY_SIZE bytes each, instead of heap-allocating
exactly the right size.
The default value of RADIOLIB_STATIC_ARRAY_SIZE is 256. When receiving
a maximum-size LoRa packet (255 bytes, equal to MAX_TRANS_UNIT),
SX126x::readBuffer() passes a 3-byte SPI command header
(CMD_READ_BUFFER + offset + NOP) plus 255 bytes of payload to
SPItransferStream(), for a total buffLen of 258 bytes. This overflows
the 256-byte stack buffers by 2 bytes, corrupting adjacent locals and
occasionally the stack canary, triggering __stack_chk_fail.
The same overflow occurs on the transmit path: SX126x::writeBuffer()
passes a 2-byte command header plus 255 bytes of payload (buffLen=257),
also overflowing the 256-byte buffer.
The overflow is small (2 bytes on the read path, 1 byte on the write
path), so it only intermittently reaches the stack canary depending on
compiler-generated stack frame layout.
Set RADIOLIB_STATIC_ARRAY_SIZE=260 to eliminate the overflow on both
paths, with 2 bytes of margin on the read path (258 < 260) and 3 bytes
on the write path (257 < 260). The value is placed in [arduino_base] so
it applies to all target platforms.
Valentin V. Bartenev