Add reactive tampering functionality to mock dispatcher

diff --git a/unit-tests/libs/mock_dispatcher.c b/unit-tests/libs/mock_dispatcher.c
index ce7cd2b..7874274 100644
--- a/unit-tests/libs/mock_dispatcher.c
+++ b/unit-tests/libs/mock_dispatcher.c
@@ -403,6 +403,19 @@ static int mock_process_interruption(dispatcher_context_t *dc) {
         return -1;
     }
 
+    /* Call tamper hook if set */
+    if (m->tamper_hook != NULL) {
+        int tamper_rc = m->tamper_hook(m->response_buf,
+                                       &m->response_len,
+                                       cmd,
+                                       m->tamper_call_count,
+                                       m->tamper_user_data);
+        m->tamper_call_count++;
+        if (tamper_rc < 0) {
+            return -1;
+        }
+    }
+
     /* Set read_buffer to point at the response */
     dc->read_buffer = buffer_create(m->response_buf, m->response_len);
     return 0;
diff --git a/unit-tests/libs/mock_dispatcher.h b/unit-tests/libs/mock_dispatcher.h
index b0e4315..f2b61b5 100644
--- a/unit-tests/libs/mock_dispatcher.h
+++ b/unit-tests/libs/mock_dispatcher.h
@@ -62,6 +62,25 @@ typedef struct {
     size_t head;                            /* next to dequeue */
 } mock_queue_t;
 
+/**
+ * Tamper hook signature.
+ * Called after a response is built but before it's delivered to the caller.
+ * Can modify response_buf/response_len to simulate malicious client behavior.
+ * Return 0 to deliver the (possibly modified) response normally.
+ * Return -1 to simulate a communication failure (process_interruption returns -1).
+ *
+ * @param response_buf   The response buffer (writable).
+ * @param response_len   Pointer to the response length (readable/writable).
+ * @param cmd            The client command that produced this response.
+ * @param call_count     How many times this hook has been called (0-indexed).
+ * @param user_data      Opaque pointer set by the test.
+ */
+typedef int (*mock_tamper_hook_t)(uint8_t *response_buf,
+                                  size_t *response_len,
+                                  uint8_t cmd,
+                                  int call_count,
+                                  void *user_data);
+
 /* ---- Main mock state ---- */
 typedef struct {
     dispatcher_context_t dc; /* MUST be first member (container_of pattern) */
@@ -96,6 +115,11 @@ typedef struct {
         size_t len;
     } yielded[MOCK_MAX_YIELDED];
     size_t n_yielded;
+
+    /* Tamper hook (NULL = no tampering, behave honestly) */
+    mock_tamper_hook_t tamper_hook;
+    void *tamper_user_data;
+    int tamper_call_count;
 } mock_dispatcher_t;
 
 /* ---- Public API ---- */
@@ -112,6 +136,19 @@ void mock_dispatcher_init(mock_dispatcher_t *mock);
  */
 void mock_dispatcher_add_preimage(mock_dispatcher_t *mock, const uint8_t *data, size_t len);
 
+/**
+ * Set a tamper hook to simulate malicious client behavior.
+ * The hook is called after each response is built, before delivery.
+ * Pass NULL to disable tampering.
+ */
+static inline void mock_dispatcher_set_tamper_hook(mock_dispatcher_t *mock,
+                                                   mock_tamper_hook_t hook,
+                                                   void *user_data) {
+    mock->tamper_hook = hook;
+    mock->tamper_user_data = user_data;
+    mock->tamper_call_count = 0;
+}
+
 /**
  * Build a Merkle tree from a list of elements and register it.
  * Also registers each leaf preimage (0x00 || element) as a known preimage.