Summary

wolfSSHD_AuthSetGroups performs the daemon's supplementary-group drop — it resolves the target user's full group list and applies it with setgroups() before wolfSSHD_AuthReducePermissionsUser reduces uid/gid. This PR started as mutation-coverage for that drop (finding f_6701) and, in the process, surfaced and fixes a real privilege-retention bug on macOS/BSD.

Motivation

Coverage gap (f_6701). Deleting the setgroups() call, or defeating its == -1 failure guard, survived the entire test suite. Unlike the setregid/setreuid path (baseline 5578), there was no WOLFSSHD_UNIT_TEST hook for setgroups, so no test observed whether it ran. With the call gone, the spawned user session retains the wolfsshd (root) process's supplementary group memberships — a concrete privilege-retention path.

Bug found while writing the test. wolfSSHD_AuthSetGroups gated the whole setgroups() block on a NULL-size getgrouplist() probe returning -1. That probe is unreliable: on macOS/BSD it returns success with size 0, so the block was skipped and the supplementary-group drop silently never ran on those platforms. The file already documents this exact unreliability and solves it with grow-and-retry in wolfSSHD_GetUserGroupNames.

Changes

• Test hooks — add WOLFSSHD_UNIT_TEST callbacks wsshd_setgroups_cb and wsshd_getgrouplist_cb, alongside the existing wsshd_setregid_cb/wsshd_setreuid_cb. Each default forwards to the real syscall through a one-line adapter, because setgroups()/getgrouplist() prototypes differ across platforms (size_t vs int, gid_t* vs int*) and a single portable function-pointer type can't bind to them directly.
• Bug fix / dedup — extract the grow-and-retry group-list sizing already used by wolfSSHD_GetUserGroupNames into a shared wolfSSHD_GetUserGroupList helper, and call it from both GetUserGroupNames and AuthSetGroups. The list is now resolved through one portable path and setgroups() runs on every platform.
• Guard consistency — standardize the wolfsshd privilege/group functions on the _WIN32 guard macro (matching the auth.h externs and the file's majority convention), so callback definitions and their references share one Windows guard and no _WIN32 && !WIN32 build can compile a caller without its definition.

Tests

The tests mock getgrouplist and setgroups, making them deterministic on every platform (the real macOS NULL-size probe would otherwise skip the drop entirely on the dev machine):

• test_AuthSetGroups_ok — asserts setgroups() is invoked with the resolved group count and the exact forwarded gids, after at least one buffer grow-and-retry (the test build forces -DWOLFSSHD_GROUP_LIST_INIT=1).
• test_AuthSetGroups_setgroups_fail — a setgroups() failure must propagate WS_FATAL_ERROR.
• test_AuthSetGroups_getgrouplist_fail — a lookup that never succeeds must fail closed and never reach setgroups().

Verification

Bug demonstrated & fixed (real, unmocked, on macOS):

Mutation kills — each defect is caught by exactly the corresponding test (others still pass):

• Full wolfsshd unit suite: 103 passed, 0 failures; normal build clean, no new warnings.
• Clean under ASan + UBSan (-fsanitize=address,undefined; LeakSanitizer disabled on Darwin).

Notes

• wolfSSHD_GetUserGroupNames behavior is unchanged (it already used this exact sizing); it now shares the helper instead of duplicating it.
• Windows and QNX paths are preserved (the stub returns 0 on success under QNX to match the getgrouplist contract).
• No production control flow changes in non-WOLFSSHD_UNIT_TEST builds beyond the sizing fix itself.