fix(client): reject invalid negotiated packet length

crates/irtt-client/src/client/tests/negotiation.rs

@@ -28,3 +28,27 @@ fn loose_negotiation_accepts_server_restricted_params() {
     returned.length = 0;
     assert!(validate_negotiated_params(&requested, &returned, NegotiationPolicy::Loose).is_ok());
 }
+
+#[test]
+fn loose_negotiation_rejects_negative_returned_length() {
+    let config = ClientConfig::default();
+    let requested = params_from_config(&config).unwrap();
+    let mut returned = requested.clone();
+    returned.length = -1;
+    assert!(matches!(
+        validate_negotiated_params(&requested, &returned, NegotiationPolicy::Loose),
+        Err(ClientError::NegotiationRejected { reason }) if reason == "length must be non-negative"
+    ));
+}
+
+#[test]
+fn strict_negotiation_rejects_negative_returned_length() {
+    let config = ClientConfig::default();
+    let requested = params_from_config(&config).unwrap();
+    let mut returned = requested.clone();
+    returned.length = -1;
+    assert!(matches!(
+        validate_negotiated_params(&requested, &returned, NegotiationPolicy::Strict),
+        Err(ClientError::NegotiationRejected { reason }) if reason == "length must be non-negative"
+    ));
+}