Fix mdns object lifetimes: don't hold pointers we don't own

[dhalbert]

• Fixes Hard Fault after successful mDNS Query and program exit #10197 (@aaron97neu)
• Fixes Bad hostname after going to the REPL when using mdns #10048 (@Neradoc)

🤖 Generated with Claude Code

This originally started as a simple fix for #10197 to copy out the IDF-held values on espressif, as was done in raspberrypi, but Claude pointed out several other problems that were all addressed here. - @dhalbert

mdns.RemoteService and mdns.Server both stored borrowed pointers whose owners could die first. This copies the data out instead.

RemoteService held IDF-owned memory (#10197)

RemoteService held an mdns_result_t allocated on the IDF heap. GC finalisers run in heap-address order, and the Server is allocated before the RemoteServices that find() returns, so at VM teardown the Server's __del__ ran first: mdns_free() deletes _mdns_service_semaphore and NULLs it, and the subsequent mdns_query_results_free() then called xSemaphoreTake(NULL, portMAX_DELAY) and hard faulted.

There is no general way to order two finalisers — gc_sweep_run_finalisers() is a single pass in block-address order with no dependency information — so rather than work around the ordering, this removes the dependency. find() copies the fields we expose into the object and frees the IDF results immediately, mirroring what the raspberrypi port already did. RemoteService then needs no finaliser at all.

Server held GC-heap strings across VM resets (#10048)

mdns_server_obj_t stored the hostname and instance_name pointers handed to it by mp_obj_str_get_str(). Those point into the GC heap, which is recycled on VM reset while the web workflow's static mdns_server_obj_t lives on, so /cp/version.json served whatever landed in that memory next — often fragments of REPL input. Both are fixed-size copies now.

raspberrypi published freed TXT records

advertise_service() stashed borrowed txt_records pointers, but lwip stores only srv_txt_cb plus the object and dereferences them later at packet-build time. A collection between advertising and being queried published freed memory onto the wire. This packs owned copies into a single buffer.

TXT records can only arrive through the Python binding, so the GC heap is necessarily available and the object shares its lifetime; assign_txt_records() carries a comment explaining what would break that assumption. This path dates to #8262.

Reject TXT records that can't be honoured

Previously more than 32 records were silently truncated on raspberrypi, and espressif accepted and discarded them entirely. Now raspberrypi raises ValueError: txt_records length must be <= 32 and espressif raises NotImplementedError: txt_records. Both reuse existing translatable strings, so locale/ is unchanged.

Also fixes the advertise_service() docstring signature, which omitted txt_records even though the parameter list documented it.

Testing

Verified on hardware, Metro ESP32-S3 and Pico 2 W:

Check	Board	Result
#10197 — find() then Ctrl-D	S3 + Pico 2 W	no crash
#10048 — hostname/instance_name across VM reset, heap churn, REPL loop	S3 + Pico 2 W	intact in version.json
TXT records survive gc.collect() before being queried	Pico 2 W	all 7 correct via avahi-browse
33 records rejected, 32 accepted	Pico 2 W	ValueError
TXT records rejected	S3	NotImplementedError

[dhalbert]

@thzinc — the TXT record changes here touch the code you added in #8262, so you may want to take a look.

EDIT: This comment was written by Claude before I could review it. @thzinc Don't worry about the changes, they fix problems, just want to keep you informed. - @dhalbert

Two things:

• advertise_service() was storing the caller's txt_records pointers, which point into GC-heap strings. lwip keeps only srv_txt_cb plus the Server object and dereferences those pointers later at packet-build time, so a collection between advertising and being queried could publish freed memory. This packs owned copies into a single buffer instead.
• Passing more than 32 records now raises ValueError rather than silently truncating to 32. If you're publishing a large HomeKit TXT set, that's the change most likely to affect you.

[tannewt]

Pretty good overall. Just a weird string copy thing

[tannewt]

Doesn't this exist already? strncpy or some such

[dhalbert]

oh yes, I meant to fix that, but there were about a dozen balls in the air.

[dhalbert]

Fixed by using strlcpy, which exists in newlib but we never happened to use. The Espressif board still needs a tiny helper strlcpy_or_empty because the source string might be NULL.

[tannewt]

Here too

[tannewt]

Dropping still means the GC could free it early. I think it'd be better to be precise.