[usualtreee]

为什么提交这份PR (why to submit this PR)

Refs: #11878

raw API DHCP 服务器的 dhcp_client_alloc() 在候选地址已占用时通过 goto 继续搜索，但没有限制搜索次数。地址池全部占用后，新 MAC 的 DISCOVER 会使该函数在 lwIP 接收路径中永久循环，后续网络报文无法处理。

本 PR 只处理地址池耗尽后的无界搜索，不加入租约到期或地址回收机制。

你的解决方案是什么 (what is your solution)

• 记录本轮搜索的第一个候选地址。
• 按原有顺序检查并推进候选地址，找到空闲地址时正常分配。
• 回到第一个候选地址即停止，确保每个池地址最多检查一次；池满时返回 NULL。
• 不计算地址池大小，不改变已有 MAC、REQUESTED_IP 或正常地址回绕行为。

仅修改 components/net/lwip-dhcpd/dhcp_server_raw.c。

请提供验证的bsp和config (provide the config and bsp)

• BSP: bsp/qemu-vexpress-a9。
• 配置：RT_USING_LWIP=y、RT_USING_LWIP203=y、LWIP_USING_DHCPD=y。
• 为缩短端到端复现时间，测试镜像临时使用 10.0.2.2～10.0.2.4 的 3 地址池；临时测试应用和配置未包含在本 PR 中。

验证结果：

1. 修复前主机复现：从原始源码提取被测函数，池满后调用在 2 秒超时限制内不返回，复现无界循环；同基线的正常分配、跳过占用、回绕等场景通过。
2. 修复后主机回归：正常分配、池满、单地址池满、已有 MAC、REQUESTED_IP 和分配失败等场景全部通过；另完成 3,586 组池大小/占用位图/起始位置组合对照测试，使用 ASAN 未报告错误。
3. QEMU 修复前：3 个客户端占满地址池后，第 4 个新客户端触发问题，已有客户端随后也无法收到 OFFER。
4. QEMU 修复后：第 4 个新客户端无 OFFER，已有客户端仍能收到 OFFER，重复池满请求不会卡死网络服务。

PASS ALLOCATION_MATRIX cases=3586
HOST_ALL_PASS
PASS SERVER_ALIVE_AFTER_EXHAUSTION yiaddr=10.0.2.2
PASS REPEATED_EXHAUSTION_NO_RESPONSE
E2E_ALL_PASS

尚未进行实板及全部架构验证；租约到期回收不在本 PR 范围内。

[github-actions]

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

---

🛠 操作步骤 | Steps

1. 前往 Actions 页面 | Go to the Actions page
   点击进入工作流 → | Click to open workflow →

2. 点击 Run workflow | Click Run workflow

• Use workflow from 保持默认分支（通常为 master）
  Keep the default branch (usually master) in Use workflow from
• 在 branch 输入框填写 PR 分支 fix/dhcpd-pool-exhaustion
  Enter PR branch fix/dhcpd-pool-exhaustion in the branch field
• 设置需排除的文件/目录（目录请以"/"结尾）
  Set files/directories to exclude (directories should end with "/")

3. 等待工作流完成 | Wait for the workflow to complete
   格式化后的代码将作为独立提交推送至你的分支。
   The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/dhcpd-pool-exhaustion 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/dhcpd-pool-exhaustion branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

[github-actions]

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)

• components/net/lwip-dhcpd/dhcp_server_raw.c

---

📊 Current Review Status (Last Updated: 2026-11-03 10:36 CST)

• ⌛ @Maihuanyi Pending Review

---

📝 Review Instructions

1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
   Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

2. 确认审核通过后评论 LGTM/lgtm
   Comment LGTM/lgtm after confirming approval

3. PR合并前需至少一位维护者确认
   PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

[github-actions]

MemBrowse Memory Report · Explore what changed →

at32f415-start

• RAM: .bss -8 B (-0.2%, 4,572 B / 32,768 B, total: 14% used)
• ROM: .text +24 B (+0.0%, 65,444 B / 262,144 B, total: 25% used)

gd32105r-start

• CODE: .text +20 B (+0.0%, 69,356 B / 262,144 B, total: 26% used)
• DATA: .bss -4 B (-0.1%, 3,748 B / 98,304 B, total: 4% used)

hc32f334

• FLASH: .text +20 B (+0.0%, 99,612 B / 131,072 B, total: 76% used)
• RAM: .bss -4 B (-0.1%, 5,328 B / 32,768 B, total: 16% used)

hpmicro-hpm5100evk

• XPI0: .text -24 B (-0.0%, 102,924 B / 1,048,576 B, total: 10% used)

infineon-psoc6

• flash: .text +20 B (+0.0%, 116,212 B / 262,144 B, total: 44% used)

k230

• SRAM: .bss -3,176 B, .data +40 B, .sbss +8 B, .stack +24 B (-0.3%, 1,206,068 B / 268,300,288 B, total: 0% used)

loongson-ls1cdev

• Code: .text +48 B (+0.0%, 363,408 B)
• Data: .bss -4 B (-0.0%, 59,808 B)

nordic-nrf51822

• FLASH: .text +20 B (+0.0%, 52,056 B / 262,144 B, total: 20% used)

nuvoton-m487

• CODE: .text +340 B (+0.1%, 356,540 B / 524,288 B, total: 68% used)
• DATA: .bss -4 B (-0.0%, 101,928 B / 163,840 B, total: 62% used)

qemu-virt64-aarch64

• Code: .text -1,024 B (-0.1%, 1,009,100 B)
• Data: .bss +944 B (+0.1%, 1,068,104 B)

raspberry-pico-rp2040

• FLASH: .text +16 B (+0.0%, 114,184 B / 2,097,152 B, total: 5% used)

renesas-ra2l1

• FLASH: .text +28 B (+0.0%, 98,304 B / 262,144 B, total: 38% used)

simulator

• Code: .text +268 B (+0.0%, 2,673,058 B)

stm32f407-rt-spark

• CODE: .text +20 B (+0.0%, 86,088 B / 1,048,576 B, total: 8% used)
• RAM1: .bss -4 B (-0.1%, 5,472 B / 131,072 B, total: 4% used)

stm32l475-atk-pandora-llvm

• ROM: .text +24 B (+0.0%, 82,712 B / 524,288 B, total: 16% used)

wch-ch32v208w-r0

• FLASH: .text +80 B (+0.1%, 159,680 B / 491,520 B, total: 32% used)

x86

• Code: .text +16 B (+0.0%, 198,941 B)
• Data: .bss -32 B (-0.2%, 14,548 B)

xuantie-e901plus

• DSRAM: .bss -8 B (-0.1%, 14,004 B / 524,288 B, total: 3% used)
• ISRAM: .rodata +16 B, .text +48 B (+0.1%, 46,424 B / 131,072 B, total: 35% used)

No memory changes detected for:

• esp32-c3
• hpmicro-hpm5301evklite
• nxp-lpc1114

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}