variable length values must be audited for safety

[taoeffect]

Any variable length-type variable provided by the input data must be:

• bounds checked and properly handled. comments about all possibilities and resolutions needed.
• highlighted in the code clearly through gratuitous comments (equivalent of yellow police caution tape. caps-lock welcome!)
• special consideration for Denial-of-Service attacks needed.

Comments also needed in Packet.parse and Packet.write that state what the buffer size is (for TCP and UDP).

A regex search for len.*= could help find them.

[taoeffect]

Also, for TCP servers, where's the async nature of the server? All this packet parsing seems synchronous, so how are gigantic messages handled without taking down the server?