net: parse NAT-PMP result code as 16-bit BE in PCP fallback #36800

When checking whether a gateway replied with NAT-PMP unsupported version (RFC 6887 appendix A and RFC 6886 section 3.5), PCPRequestPortMap mistakenly used PCP_RESPONSE_HDR_RESULT_OFS (3) and compared only a single byte against NATPMP_RESULT_UNSUPP_VERSION.

NAT-PMP result codes are 16-bit big-endian values starting at offset 2 (NATPMP_RESPONSE_HDR_RESULT_OFS). A 16-bit result code with low byte 1 and a non-zero high byte (such as 0x0101) would previously be incorrectly treated as UNSUPP_VERSION.

This PR fixes the check to use ReadBE16(response.data() + NATPMP_RESPONSE_HDR_RESULT_OFS) matching the rest of pcp.cpp (lines 348 and 390), and uses NATPMP_HDR_VERSION_OFS for the version field offset. A unit test is added to pcp_tests.cpp.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

External sites

• Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36800
• Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36800.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36800#author-ralph

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

LLM Linter (✨ experimental)

Possible places where named args for integral literals may be used (e.g. func(x, /*named_arg=*/0) in C++, and func(x, named_arg=0) in Python):

• src/test/pcp_tests.cpp: PCPRequestPortMap(TEST_NONCE, default_gateway_ipv4, bind_any_ipv4, 1234, 1000, g_interrupt, 1, 1000ms)

^{2026-11-08 06:24:44}