docs: track nwbind endpoint handoffs

src/nwbind.c

@@ -802,6 +802,16 @@ static void handle_fxx(int gelen, int func)
       default :   completition=0xfb; /* not handled  */
     }
   } else if (0x17 == func) { /* Fileserver Enviro */
+    /*
+     * NCP 0x2222/23 File Server Environment forwarded from nwconn.c.
+     * handle_fxx() consumes the standard grouped header before this switch:
+     *   requestdata[0..1]  SubFuncStrucLen
+     *   requestdata[2]     SubFunctionCode
+     *   rdata              payload after SubFunctionCode
+     * Several queue subfunctions are preprocessed by nwconn before they reach
+     * this handler, so endpoint audits must include both the nwconn mutation
+     * and the final nwbind parser below.
+     */
     switch (ufunc) {
      case 0x01 :  { /* Change User Password OLD */
                      completition=0xff;
@@ -2067,14 +2077,23 @@ static void handle_fxx(int gelen, int func)
                   break;
     }  /* switch */
   } else if (func == 0x18) {  /* End of Job */
+    /* Forwarded direct NCP 0x2222/24 cleanup after nwconn releases local handles. */
     if (!(entry8_flags&0x200)) /* pcz: 14-Apr-00 */
       nw_close_connection_jobs(act_connection, ncprequest->task); /* close print jobs */
   } else if (func == 0x19) {  /* logout */
+    /* Forwarded direct NCP 0x2222/25 logout cleanup after nwconn resets connection state. */
     nw_close_connection_jobs(act_connection, -1);  /* close all print jobs */
     write_utmp(0, act_connection, act_c->pid_nwconn, &(act_c->client_adr), NULL);
     act_c->object_id  = 0; /* not LOGIN  */
     act_c->id_flags   = 0; /* no flags   */
   } else if (0x20 == func) { /* Semaphore */
+    /*
+     * NCP 0x2222/32 Semaphore forwarded from nwconn.c.
+     * This group is parsed differently from 0x15/0x16/0x17:
+     *   ufunc = requestdata[0]
+     *   rdata = requestdata + 1
+     * handle_func_0x20() owns the concrete semaphore subfunction layouts.
+     */
     int result = handle_func_0x20(act_c, rdata, ufunc, responsedata);
     if (result > -1) data_len = result;
     else completition=(uint8)-result;