chore: add SPDX license headers to every source file

.github/workflows/rust.yml

@@ -16,6 +16,10 @@ jobs:
         with:
           submodules: recursive
       - run: python3 scripts/ci_benchmarks/test_gateway_summary.py
+      - name: SPDX license headers
+        run: |
+          missing="$(git ls-files '*.rs' '*.sh' '*.py' '*.c' '*.h' ':!third_party' ':!website' | xargs grep -L 'SPDX-License-Identifier: Apache-2.0' || true)"
+          [ -z "$missing" ] || { echo "missing SPDX header:"; echo "$missing"; exit 1; }
       - run: cargo fmt --check
       - run: cargo clippy --workspace --all-targets -- -D warnings
 

crates/mq-h3/src/conn.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! One `h3wire::Connection` per H3 conn, and the raw events it consumes (adoption spec §4.2,
 //! §4.4).
 

crates/mq-h3/src/lib.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `H3Wire<T>`: a `TransportOps` decorator serving HTTP/3 from h3wire (adoption spec §4.1).
 //!
 //! Runs one h3wire `Connection` per H3 conn and serves the

crates/mq-h3/src/queue.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Outer event queue (adoption spec §4.1): level events coalesce, stale ones drop on pop.
 
 use mq_transport_api::{Event, SlotId};

crates/mq-h3/src/recv.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Request receive: HEADERS bootstrap, header delivery, body pull and the request-stream
 //! transport events (adoption spec §4.3, §4.4).
 

crates/mq-h3/src/req.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Per-request state (adoption spec §4.3).
 
 use crate::queue::OutQueue;

crates/mq-h3/src/send.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! h3wire actions and core bytes on the transport (adoption spec §4.5).
 
 use crate::H3Wire;

crates/mq-h3/tests/common/mod.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `Rig`: an `H3Wire<ScriptedTransport>` joined to a real `h3wire::Connection` peer.
 #![allow(dead_code)]
 

crates/mq-h3/tests/lifecycle.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Request lifecycle: closure conditions, `h3_reset`, the connection-close fan-out with
 //! client-side retention, and stale ids after close (adoption spec §4.3, §5.1, §5.2).
 

crates/mq-h3/tests/props.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Property test (adoption spec §6.1, §5.4, §4.3): random peer, gateway and transport steps
 //! over a `Rig`, both roles.
 //!

crates/mq-h3/tests/recv.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Request receive: HEADERS bootstrap, `h3_recv_headers`, body pull, carry and
 //! "reset, code pending" (adoption spec §4.3 "Start", §4.4, §5.3 (2), (3), (6)).
 

crates/mq-h3/tests/send.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Request send: client start, DATA framing with partial writes, the finish latch, the
 //! pending FIN, `SendStopped` per role and GOAWAY (adoption spec §4.3 "Start", §4.4, §4.5).
 

crates/mq-h3/tests/setup.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! H3 connection setup over the `Rig` (adoption spec §4.2, §4.4, §4.5).
 
 mod common;

crates/mq-h3/tests/stats.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Request metrics: the `H3ReqStats` of `H3Closed` (adoption spec §4.6).
 
 mod common;

crates/mq-http/fuzz/fuzz_targets/format_req.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 #![no_main]
 use libfuzzer_sys::fuzz_target;
 use mq_http::metrics::{ReqLine, format_req};

crates/mq-http/fuzz/fuzz_targets/h1_head.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 #![no_main]
 use libfuzzer_sys::fuzz_target;
 

crates/mq-http/fuzz/fuzz_targets/parse_target.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 #![no_main]
 use libfuzzer_sys::fuzz_target;
 

crates/mq-http/src/h1.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! HTTP/1.1 request head parser (spec §2.1).
 
 pub const HEAD_MAX: usize = 16 * 1024;

crates/mq-http/src/headers.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Gateway header rules (spec §2.3).
 
 use crate::h1::is_tchar;

crates/mq-http/src/lib.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Pure HTTP/1.1 helpers for the gateway (spec §2). No I/O.
 #![forbid(unsafe_code)]
 pub mod h1;

crates/mq-http/src/limits.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Shared nginx-like header limits for both gateway ends (SP4 spec §5).
 
 /// One header field: name + value bytes.

crates/mq-http/src/metrics.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `mq.req` log-line formatter (spec §2.4).
 //! Works on bytes: no `String`, truncation is bytewise.
 use std::io::Write;

crates/mq-integration/src/browser.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `TestBrowser` (SP4 spec §11.3): a browser stand-in for the MITM pair tests. It speaks
 //! rustls (client) + `h2::client` on a tokio current_thread runtime, driven by the calling
 //! thread (`block_on`), over TCP to the proxy's `TRANSPARENT` listener only. TLS uses SNI

crates/mq-integration/src/driver_harness.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! The driver harness (spec §8.1 "Driver"): the production `Driver` on its
 //! own thread over a `ScriptedTransport` and a `RecordingApp`, real loopback
 //! sockets, and a resolver the test answers on command. `DriverThread` is

crates/mq-integration/src/h3_apps.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! H3 test apps (spec §10.3): an echo server with fault modes and a scripted client. Both run
 //! on a `DriverThread`, where an app can be neither commanded nor inspected, so their scripts
 //! are fixed at spawn and their observations come back through an `H3Handle`.

crates/mq-integration/src/lib.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! spec §8.1
 #![forbid(unsafe_code)]
 

crates/mq-integration/src/log_tap.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! A process-global `log::Log`, for shards on other threads (`DriverThread`), where the
 //! thread-local `mq_runtime::testing::log_capture` cannot see them. Lines accumulate across
 //! the tests of one binary: each test filters by its own markers.

crates/mq-integration/src/loopback.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! The loopback harness (spec §8.1 "Loopback"): a server side and a client
 //! side, each a production `Driver` with a shard over the real transport,
 //! each on its own thread, talking over loopback UDP. The test thread plays

crates/mq-integration/src/origin_loop.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `OriginLoop`: the origin bridge (`OriginHost`) on the production loop core
 //! over real sockets, on the **test thread** — a `DriverThread` can neither be
 //! commanded nor inspected, and `StartReq` holds `!Send` state (spec §10.3).

crates/mq-integration/src/origin_server.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `OriginServer`: a real origin for the bridge tests (spec §10.3). The hyper
 //! modes run a hyper 1.10 **server** on a tokio current_thread runtime on a
 //! std thread (TLS through tokio-rustls); the raw modes are canned-bytes peers

crates/mq-integration/src/raw_h3.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! The raw-H3 peer (adoption spec §6.2): HTTP/3 as fixed bytes on raw streams, for the
 //! malformed input a compliant H3 send API cannot produce.
 

crates/mq-integration/src/shard_pair.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! The shard-pair harness (spec §8.1 "Shard pair"): a server shard and a
 //! client shard, each with the real xquic `Transport` inside a `LoopCore`
 //! over a `FakeIo` (auto-advance off) on virtual time, each on its own thread

crates/mq-integration/tests/common/mod.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Rigs for the driver tests with the real apps (spec §8.1 "Driver", rerun
 //! with the real `Client`/`Server`): the production `Driver` on its own
 //! thread, a `ScriptedTransport` in polling mode (so events the test injects

crates/mq-integration/tests/driver_client_relay.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Driver tests with the real `Client` (spec §8.1, §8.4, §6.2): a SOCKS5
 //! request through the production driver, the scripted transport answering
 //! the open, then the relay.

crates/mq-integration/tests/driver_emfile.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! spec §5.3 `EMFILE` retry, alone in its binary: it lowers the
 //! process-wide `RLIMIT_NOFILE`.
 

crates/mq-integration/tests/driver_loopback.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Driver tests (spec §8.1 "Driver"): the production driver over real
 //! loopback sockets with a `RecordingApp`.
 

crates/mq-integration/tests/driver_server_dial.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Driver tests with the real `Server` (spec §8.1, §8.4, §6.3): the dial of a
 //! data stream's `CONNECT_TCP_REQUEST` through the production driver — its
 //! resolver, connect deadline and late answers — with the transport scripted.

crates/mq-integration/tests/driver_socks5_listener.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Spec §8.1, §6.1: the real `Client`'s SOCKS5 and HTTP CONNECT listeners
 //! under the production driver; the test is the ingress client, and the
 //! scripted transport stands in for the server (AUTH answered by the rig,

crates/mq-integration/tests/loop_e2e_single_path.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Single-path cases on the loopback harness (spec §8.1 "Loopback"): the real `Server` and `Client` on real transports,
 //! each on its own production driver thread, over loopback UDP. The test
 //! thread plays the origin (`TcpListener`) and the application (`TcpStream`

crates/mq-integration/tests/loop_engine_boot.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Engine boot on the loopback harness (spec §8.1 "Loopback"): both sides
 //! boot (real xquic engine, production driver, each on its own thread) on
 //! `127.0.0.1:0`, the client completes a handshake with the server, and each

crates/mq-integration/tests/origin_h1.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! The origin bridge against a real hyper h1 origin (spec §7.7 "h1 conns",
 //! §10.3), on the `OriginLoop` / `OriginServer` harness.
 

crates/mq-integration/tests/origin_h2.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! The origin bridge against a real hyper h2 origin (spec §7.7 "h2 conns",
 //! "Idle sweep", §10.3), on the `OriginLoop` / `OriginServer` harness.
 

crates/mq-integration/tests/pair_cs.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Client↔server cases on the shard pair (spec §8.1 "Shard pair"):
 //!
 //! | case | test | client side |

crates/mq-integration/tests/pair_failures.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Shard-pair failure injection (spec §8.4, the "shard pair" rows; §6.3
 //! server streams and auth; §5.6 relay ends).
 #![forbid(unsafe_code)]

crates/mq-integration/tests/pair_gateway.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! spec §10.3 (H3 pair, gateway items): the fetch client and the gateway server on two
 //! production drivers over loopback UDP, real xquic, against real origins. The test thread
 //! plays the local fetch caller (HTTP/1.1 over `std::net`) and, for the direct-H3 cases, an

crates/mq-integration/tests/pair_h3.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! spec §10.3 (H3 pair, §3.7): the H3 test apps on two production drivers over loopback UDP,
 //! real xquic on both sides.
 #![forbid(unsafe_code)]

crates/mq-integration/tests/pair_max_conns.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! `max_conns` on the shard pair (spec §8.1 "Shard pair", §4.7 `max_conns`):
 //! clients A, B and C are three connections of one `RawClient` (each sends the
 //! `AUTH_REQUEST`), counted by `Transport::conn_count`.

crates/mq-integration/tests/pair_metrics.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Active-connection metrics on the shard pair (spec §8.1 "Shard pair",
 //! §6.5: the server reports the most recently *accepted* connection — set at
 //! `NewConn`, before auth — and clears it only when that same connection

crates/mq-integration/tests/pair_mitm.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! SP4 spec §11.3: the MITM client and the gateway server on two production drivers over
 //! loopback UDP, real xquic, against real origins. The test thread plays the browser
 //! (`TestBrowser`: rustls + `h2::client`), connecting only to the client's `TRANSPARENT`

crates/mq-integration/tests/pair_rc.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Client reconnect on the shard pair (spec §8.1 "Shard pair", §6.2
 //! reconnect), real `Client` and `Server`. Case 3 covers the TCP half only
 //! (UDP reconnect is SP2).

crates/mq-integration/tests/pair_reconnect.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Shard-pair reconnect tests (spec §8.4 "QUIC connection lost", "Accept
 //! during reconnect"; §6.2 Backoff and pending requests).
 #![forbid(unsafe_code)]

crates/mq-integration/tests/pair_relay.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Shard-pair tests (spec §8.1 "Shard pair", §8.4): the real `Client` and
 //! `Server` relaying end to end below the syscall layer, on one and two paths.
 #![forbid(unsafe_code)]

crates/mq-integration/tests/pair_udp.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! SP2 spec §10.3: the UDP relay on the shard pair — the real `Client` and
 //! `Server` over the real xquic pair, with the SOCKS5 UDP app played on the
 //! client's `FakeIo` and the UDP target (an echo) on the server's. Then the

crates/mq-linux/src/lib.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! spec §2.2
 
 pub mod listener;

crates/mq-linux/src/listener.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! IPv4 TCP listener construction. spec §2.2 / §5.3: `SO_REUSEADDR` and
 //! optional `IP_TRANSPARENT` are set before `bind`; backlog 64; non-blocking.
 

crates/mq-linux/src/process.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Process helpers. spec §2.2.
 
 use crate::sockopt::cvt;

crates/mq-linux/src/sockopt.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Socket options and sockaddr conversion. spec §2.2.
 //!
 //! `original_dst` reads the pre-NAT destination of a REDIRECTed TCP flow;

crates/mq-linux/src/timerfd.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! Non-blocking `CLOCK_MONOTONIC` timerfd armed at absolute deadlines.
 //! spec §2.2.
 

crates/mq-linux/src/udp.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 //! UDP sockets with GSO (`UDP_SEGMENT`) send and GRO (`UDP_GRO`) batched
 //! receive. spec §2.2. IPv4 or IPv6 by the bind address. An IPv6 socket is
 //! dual-stack (`IPV6_V6ONLY` = 0): it sends to IPv4 destinations as v4-mapped

crates/mq-linux/tests/listener.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 // spec §2.2 / §5.2 / §5.3: listener construction and socket options.
 use mq_linux::{TcpListenerBuilder, geteuid, original_dst, set_linger_zero, so_error};
 use std::io::{ErrorKind, Read};

crates/mq-linux/tests/timerfd.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 // spec §2.2: timerfd armed at an absolute CLOCK_MONOTONIC deadline.
 use mq_linux::{TimerFd, now_monotonic_micros};
 use std::io::ErrorKind;

crates/mq-linux/tests/udp.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 // spec §2.2: UDP GSO/GRO sockets on loopback.
 use mq_linux::{MAX_GSO_BYTES, RecvMeta, UdpSocket};
 use std::io::ErrorKind;

crates/mq-proxy/fuzz/fuzz_targets/http_connect.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 #![no_main]
 //! spec §6.1: the HTTP CONNECT parser driven as the app would, whole and in data-sized chunks.
 use libfuzzer_sys::fuzz_target;

crates/mq-proxy/fuzz/fuzz_targets/socks5.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 #![no_main]
 //! spec §6.1: the SOCKS5 parser driven as the app would, whole and in data-sized chunks.
 use libfuzzer_sys::fuzz_target;

crates/mq-proxy/fuzz/fuzz_targets/socks5_udp_hdr.rs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 mp0rta and mqproxy contributors
 #![no_main]
 //! spec §5: any accepted header rebuilds byte for byte and parses back to itself.
 use libfuzzer_sys::fuzz_target;