fix: SHELL_Subsystem returns without restoring raised privileges

[MarkAtwood]

Bug

SHELL_Subsystem() (apps/wolfsshd/wolfsshd.c) temporarily raises privileges via
wolfSSHD_AuthRaisePermissions(conn->auth) to look up user information. Four
error paths between that raise and the normal privilege drops return
WS_FATAL_ERROR without restoring privileges:

• pipe(stdoutPipe) failure
• pipe(stderrPipe) failure
• pipe(stdinPipe) failure
• forkpty() failure

The caller discards the return value, so the per-connection handler proceeds
through teardown still elevated. This only has effect when
UsePrivilegeSeparation is yes/sandbox (otherwise the raise is a no-op), and
reaching it requires fd/process exhaustion, so severity is low — but the raise
should always be paired with a drop.

Fix

Restore privileges with wolfSSHD_AuthReducePermissions(conn->auth) before each
of the four early returns, matching the existing exit(1)-on-drop-failure
handling used on the normal child/parent paths.

Verification

Built --enable-all (incl. wolfsshd) against wolfSSL master; compiles clean.

Reported by static analysis (Fenrir finding F-6980).

[Copilot]

Pull request overview

Fixes a privilege-separation correctness issue in SHELL_Subsystem() (wolfsshd) where several early error returns could leave the per-connection handler running with temporarily raised privileges.

Changes:

• Drop raised privileges via wolfSSHD_AuthReducePermissions(conn->auth) before returning on pipe() failures (stdout/stderr/stdin).
• Drop raised privileges via wolfSSHD_AuthReducePermissions(conn->auth) before returning on forkpty() failure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.