bugfix rtt

        return -1;

    }

    // RFC 9000 §8.1 anti-amplification limit: until the peer's address is

    // validated, never send more than 3x what's been received from it.

    // Known consequence (not something this checks tries to work around):

    // a large enough handshake flight (e.g. an oversized certificate

    // chain) may need more than one round trip to complete under strict

    // enforcement — see _address_validated's comment in socket.h.

    if (!_address_validated && _bytes_sent_unvalidated + len > 3 * _bytes_received_unvalidated) {

    // RFC 9000 §8.1 anti-amplification limit: prior to validating the

    // CLIENT's address, a SERVER must never send more than 3x what it has

    // received from that address (protects a third party from having this

    // server used as a reflector against a spoofed victim IP). This is not

    // a restriction on the client's own sends — a client isn't a

    // reflection risk to anyone, and gating it here would (and, before

    // this `_is_server` guard was added, silently did — caught by 0-RTT's

    // sendStreamDataEarly() being the first client code path to ever call

    // through sendPacket() before receiving anything back from the server)

    // block a client's own 0-RTT packets from ever going out at all, since

    // _bytes_received_unvalidated is necessarily still 0 for a connection

    // that hasn't heard back from the server yet. (The client's very first

    // Initial send happens to dodge this today via a different code path —

    // connect() calls udp::sendData() directly rather than through here —

    // but that's incidental, not a substitute for gating this correctly.)

    // Known consequence for the server side (not something this check

    // tries to work around): a large enough handshake flight (e.g. an

    // oversized certificate chain) may need more than one round trip to

    // complete under strict enforcement — see _address_validated's comment

    // in socket.h.

    if (_is_server && !_address_validated && _bytes_sent_unvalidated + len > 3 * _bytes_received_unvalidated) {

        QUIC_DBG("sendPacket: anti-amplification limit reached, dropping %zu bytes "

                 "(sent=%lu recv=%lu)", len, (unsigned long)_bytes_sent_unvalidated,

                 (unsigned long)_bytes_received_unvalidated);