GeezerVison

SSLProtocol read flow control only looked at the incoming BIO, so records OpenSSL writes on its own while processing a non-reading peer's input (TLS 1.2 renegotiation alerts, TLS 1.3 KeyUpdate replies) accumulated in the outgoing BIO without any bound. This counts that non-application output toward the read high-water mark and re-checks it from resume_writing(), so the transport stops reading from a peer that does not take the replies it solicits and resumes once it does. Application output is deliberately left out of the sum so that two peers which both write before they read cannot deadlock. The bound is coarse because the check runs after a whole transport read has been processed, so a single ~256 KiB read can still leave about 5.6 MB in the outgoing BIO before reads pause; resume_writing() now re-checks reading in every state rather than only from _do_read().

Fixes #160499

ANT-2026-RNWRQ22W

• Issue: asyncio TLS server memory grows without bound for a peer that stops reading #160499