- Add 500 ms minimum interval between accepted ACKs to mitigate replay floods - Reject ACK packets from unrecognised device IDs (DeviceIdMismatch) - Add test/test_security_fuzz: negative/boundary tests for decode_batch, uleb128_decode, svarint_decode, lora_parse_frame entry points