QEMU patches websocket DoS crashes, deprecates AF_ALG crypto

QEMU is merging fixes for CVE-2026-84788, a set of denial-of-service bugs in its websocket I/O path that let an unauthenticated client crash the process during the handshake, including on VNC websocket ports.

Denis V. Lunev found several places where the handshake treated ordinary non-blocking I/O conditions and malformed HTTP greetings as fatal errors, then tried to format a NULL error object. A zero-length socket write was misclassified as failure; a request line with no space left an empty response buffer that still triggered a flush; and blocked reads or writes under TLS could the same way take down the emulator before any authentication. The fixes return proper HTTP 400 responses, keep waiting when the socket blocks, and add regression tests for those cases. Stable trees are in scope.

In the same misc pull, Daniel P. Berrangé deprecated QEMU's AF_ALG crypto backend. Linux 7.2 has deprecated AF_ALG and documented it as slower than userspace crypto after losing zero-copy and accelerator support. QEMU mainly used it under virtio-crypto's builtin backend; other backends already cover kernel and hardware offload, so AF_ALG will leave after a deprecation window starting in 11.2.

Berrangé also updated the security policy: bugs that depend only on uninitialized stack variables will generally not be treated as security issues, because the build forces zero-initialization of stack vars in supported compilers. Minor x509 error-propagation fixes ride along.