fix(telemetry): HoTT out-of-bounds warning byte and null sensor lookup

[3djc]

Review triggered by comments from @bsongis :)

True issue:
processHoTTWarnings() reads packet[14] (the device warnings byte) for every page 1-4 frame, but the MultiProtocol dispatcher only validated len >= 14, so with a 14-byte frame the warning code came from stale telemetryRxBuffer content and could raise a spurious HoTT warning. The frame is documented as [0]..[14]; the guard predates the warnings byte.

Possible issue if miss edit happens on HOTT data tables
getHottSensor() returned nullptr on a miss while ~60 call sites in processHottPacket() dereference the result unguarded. Return the table's sentinel entry instead so an unknown ID degrades to UNIT_RAW/precision 0; hottSetDefault() now tests sensor->name to detect a real match.

[3djc]

@mha1 , you introduced a lot of HoTT changes, I don't have any HoTT to test, would you mind testing this a bit ?

[mha1]

Is this based on occurring issues? I don't think anyone would experience any issues with current firmware:

• the MPM with firmware even years old sends a fixed 15 Byte packet for HoTT telemetry. The check for >= 14 never fails. HoTT telemetry with MPM firmware prior to the warning byte addition will stop working after updating the check against 15.
• If HoTT telemetry is active there's never the case of no HoTT device, i.e. there's never a nullptr returned. The RX is always present. It is a HoTT telemetry device itself, is listed in hott_sensors and is the one carrying the warning byte. The RX will always be found or there's no telemetry at all. And as long as telemetry is up and running there's no stale warning.

Anhyhow, the nullptr change looks correct (and better), but solving a problem that I think doesn't exist.

The change to checking for >= 15 bytes is up to you. You're just cutting ties with ancient pre-warning MPM firmware.

I tested the changes with a GR-16, HoTT Vario, 4s voltage Module (acts as GAM) and MPM firmware that is sending the warning byte (15 byte packets):

• sensor discover works
• telemetry works
• HoTT Lua works

[3djc]

I agree with the 15 limit, but the nul ptr stays a risk, even if I agree with you that it currently doesn't materialize

[mha1]

I agree with the 15 limit, but the nul ptr stays a risk, even if I agree with you that it currently doesn't materialize

No objection