test: fix SNMPv3 negative test against USM key cache

The wrong-password test passed authentication because net-snmp caches
localized USM keys per (engineID, username) for the process lifetime. An
earlier test had already authenticated as testuser with the correct
passphrase, so the cached key was reused and the bad passphrase never
reached the agent -- the test was asserting on the cache, not the agent.

Use a dedicated 'baduser' that no passing test ever authenticates as, so
its cache entry is only ever populated from the wrong passphrase. Also
add an unknown-user case, which is rejected agent-side and so cannot be
affected by client caching at all.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014KG1c9XtKawkvig5PnZjC8

Author: bluecmd

netsnmp/tests/system/snmpd.conf

@@ -7,3 +7,11 @@ rwcommunity private 127.0.0.1
 # netsnmp/tests/system/common.py.
 createUser testuser SHA "auth_pass" AES "priv_pass"
 rwuser testuser authPriv
+
+# Only ever contacted with a deliberately wrong passphrase, by
+# test_wrong_auth_password_is_rejected. It must not be used by any passing
+# test: net-snmp caches localized USM keys per (engineID, username) for the
+# life of the process, so a successful auth would prime that cache and mask
+# the rejection we are asserting.
+createUser baduser SHA "correct_auth_pass" AES "correct_priv_pass"
+rouser baduser authPriv

netsnmp/tests/system/test_v3.py

@@ -46,11 +46,24 @@ def test_session_get(self):
         varlist = netsnmp.VarList(netsnmp.Varbind(SYS_DESCR, '0'))
         assert_value(self, session.get(varlist))
 
+    def test_unknown_user_is_rejected(self):
+        session = netsnmp.Session(**dict(V3_ARGS, SecName='nosuchuser'))
+        varlist = netsnmp.VarList(netsnmp.Varbind(SYS_DESCR, '0'))
+        values = session.get(varlist)
+        self.assertFalse(values and values[0])
+
     def test_wrong_auth_password_is_rejected(self):
-        """Proves the agent really enforces authPriv, so the tests above
-        are not silently passing over an unauthenticated session."""
-        args = dict(V3_ARGS, AuthPass='wrong_auth_pass')
-        session = netsnmp.Session(**args)
+        """Proves the agent really enforces authPriv, so the tests above are
+        not silently passing over an unauthenticated session.
+
+        Uses a dedicated user rather than the one above: net-snmp caches
+        localized USM keys per (engineID, username) process-wide, so reusing
+        a name that already authenticated successfully would reuse the good
+        key and the wrong passphrase would never reach the agent.
+        """
+        session = netsnmp.Session(
+            **dict(V3_ARGS, SecName='baduser', AuthPass='wrong_auth_pass',
+                   PrivPass='wrong_priv_pass'))
         varlist = netsnmp.VarList(netsnmp.Varbind(SYS_DESCR, '0'))
         values = session.get(varlist)
         self.assertFalse(values and values[0])