AIKIDO-2026-59367

TL;DR

The pre-authentication line readers in the asyncio and GLib message bus backends read the D-Bus auth handshake into a buffer without any size cap and without handling a closed connection. A hostile peer that streams bytes without a terminating CRLF forces the buffer to grow until host memory is exhausted, and on the asyncio path an abrupt disconnect makes the reader spin on empty reads and hang. The fix caps the auth line at 16 KiB, reads in bounded chunks, and raises an AuthError when the peer sends EOF mid-handshake. Both _auth_readline and the GLib _AuthLineSource now surface the error instead of growing unbounded or looping forever.