Wasabi v2.3.8-beta

This release consolidates module hardening through a deep audit of memory management and strict compliance with RFC 6455 (WebSocket) and MQTT v5 specifications. The focus of this update was to eliminate undefined behavior in long-running systems and ensure data integrity during large-scale data streams.

Bug Fixes

WebSocket Protocol (RFC 6455)

ProcessCloseFrame: Corrected response array allocation
The previous implementation had a flaw in the replyFrame array dimension when handling server-initiated closes. The code now performs dynamic ReDim based on the presence or absence of a payload (reason string) in the close frame, ensuring that the header and the 4-byte mask are transmitted without memory corruption or index errors.

SendPongFrame: Masking key precedence order
The logic for constructing the PONG frame has been corrected. Assigning the mask to the frame's control bytes now occurs before the XOR encryption process. This ensures that the PONG payload is always masked with values already persisted in the output buffer, strictly aligning with BuildWSFrame behavior.

ProcessFrames: Strict validation of reserved bits (RSV2/RSV3)
In compliance with section 5.2 of RFC 6455, the frame parser now validates if reserved bits 2 and 3 are active. Since Wasabi does not negotiate extensions using these bits, their presence now results in the immediate termination of the connection with error code 1002 (Protocol Error), protecting the client against malformed or incompatible data streams.

WebSocketSendClose: FSM refinement in STATE_CLOSING
The state transition during the termination handshake has been improved. The module now correctly signals the STATE_CLOSING status and waits for the server's close echo before releasing socket resources, preventing "socket hung" errors during rapid connect/disconnect cycles.

MQTT v5

MqttUnsubscribe: Fixed static Packet ID
Fixed a bug where MqttUnsubscribe used a fixed Packet ID (10). The function now correctly utilizes the MqttNextPacketId global counter, ensuring each unsubscription request has a unique identifier, which is essential for tracking UNSUBACK in complex sessions.

MqttReceive: Migration from literals to protocol constants
The processing of disconnect packets was refactored to use the MQTT_DISCONNECT constant instead of the numeric literal 14. This change ensures code consistency and prevents silent breaks if the internal enumeration is expanded or modified in the future.

MqttPublish: PayloadLen calculation stabilization
Removed the use of the IIf function in the publication packet size calculation. In VBA, IIf always evaluates both arguments, which could introduce unwanted side effects. The calculation now uses a standard conditional structure, ensuring that space for the Packet ID is only reserved when QoS is greater than 0.

Memory Management and x64 Correctness

EnsureBufferCapacity: Expanded memory ceiling to 256 MB
The previous 16 MB limit for data fragments was identified as insufficient for industrial use cases and large binary payload transfers. The safety limit has been raised to 256 MB, with an aggressive growth strategy to minimize memory reallocations during frame accumulation.

Base64Encode: x64 idiomatic array initialization check
The input array integrity check was corrected to use the idiomatic (Not Not Bytes) = 0 pattern. The previous approach was inconsistent and could fail on 64-bit hosts due to how VBA handles pointers for uninitialized SafeArrays.

ReceiveHTTPResponse: TLS buffer draining
Fixed a flaw where the recvBuffer was not properly cleared after the successful extraction of an HTTP header on secure connections. This prevents old handshake remains from being reprocessed by the TLSDecrypt function, eliminating "Incomplete Message" errors in WSS Proxy tunnels.

WebSocketGetStats: Overflow protection for long-running connections
The uptime variable was converted from Long to Double. The previous calculation suffered from a signed overflow error after approximately 24 days of active connection. The new logic supports virtually unlimited connection times while maintaining telemetry calculation accuracy.

Notes

This release retains the -beta suffix while we finalize the validation of the new 256 MB memory model in Access 32-bit environments. The MQTT 5.0 and WebSocket WSS communication core is considered stable for integration into real-time automation and monitoring tools.

If you encounter any regression, please open a GitHub Issue detailing the scenario and the error code returned by WasabiGetErrorDescription.

MQTTX Bug Reported by Savings_Mission_534 https://www.reddit.com/r/vba/comments/1t9q3nc/comment/ol4zycm