[ Reason ]
wolfSSL 5.9.4 (uploaded to unstable as 5.9.4-1) fixes a new batch of
CVEs. I would like to fix the ones affecting trixie through a point release, as was done
for 5.7.2-0.1+deb13u2 (#1141816).

[ Impact ]
Without the update trixie users remain vulnerable to
CVE-2026-93302 (High)  trusted peer match ignores the public key
CVE-2026-89102 (High)  status_request_v2 multi: any chain cert used as CA
CVE-2026-89136 (High)  unsolicited RawPublicKey server cert type accepted
CVE-2026-93304 (Med)   TLS 1.2 client accepts early ChangeCipherSpec
CVE-2026-89134 (Med)   Subject CN name constraint skipped with non-DNS SAN
CVE-2026-15442 (Low)   use-after-free in shutdown/read sequence
CVE-2026-94417 (Low)   CRL check skipped when no OCSP responder is named

Checked and not affected in the trixie build: CVE-2026-89135 (no
WOLFSSL_TEMP_CA path in 5.7.2), CVE-2026-94418 (WOLFSSL_SMALL_CERT_VERIFY
not built), CVE-2026-94419 (built with NO_SESSION_CACHE_REF).
CVE-2026-89133 is affected but deferred: its upstream fix changes the
layout of the installed struct Signer.

[ Tests ]
 - Built with sbuild in a clean trixie chroot (trixie + trixie-security).
 - ABI unchanged: soname libwolfssl.so.42 and the exported symbol set of
   the new library are identical to 5.7.2-0.1+deb13u2 (3398 symbols);
   debian/libwolfssl42t64.symbols is unchanged.
 - testwolfcrypt passes.
 - --enable-all API test suite (974 tests), each test run individually
   against the unpatched deb13u2 source and the patched source: identical
   pass/fail results for every test (the existing failures are
   environmental and occur without these patches too).

[ Risks ]
Minimal backports of upstream fixes, no upstream version or ABI change.
Three fixes had to be adapted to 5.7.2 without the upstream refactors
they build on:
 - CVE-2026-93302: upstream replaces the TrustedPeerCert fields with a
   certificate hash; to keep the installed struct layout this stores the
   whole certificate DER in the existing sig buffer and requires an exact
   match instead.
 - CVE-2026-94417: 5.7.2 has no OCSP_NO_URL/OcspNoUrlPolicy(), so the
   no-responder case is detected from the certificate's AIA field.
 - CVE-2026-89102: pending-CA checks applied to the inline 5.7.2 code.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
  * CVE-2026-93302: require trusted peer certificates to match byte for
    byte.
  * CVE-2026-93304: reject ChangeCipherSpec before ClientKeyExchange is
    sent.
  * CVE-2026-15442: fix use-after-free in TLS shutdown/ReceiveData
    sequences.
  * CVE-2026-94417: check the CRL when a certificate names no OCSP
    responder.
  * CVE-2026-89134: apply Subject CN name constraints unless a dNSName
    SAN is present.
  * CVE-2026-89102: only admit CAs to the status_request_v2 pending
    signer pool.
  * CVE-2026-89136: reject unoffered server certificate types with RPK.

Attachment: wolfssl_5.7.2-0.1+deb13u3.debdiff

Just to be clear: wolfssl 5.9.4-1 is not yet uploaded to unstable.
I will untag moreinfo when it is done.

I have just uploaded the changes to unstable.