This is going to be very, very difficult to do which is why we've removed it from the RHEL board and lowered the priority. Basically, lrmd_send_command implements almost all of the API commands for a lrmd_t. All of those would need to be converted over to an async style, and then all of their callers would be. This includes major portions of the control daemon, which isn't very well set up to call the async versions of these functions. It would require rewriting much of liblrmd and the control daemon, and there's simply not enough time to get around to a project of that size.

cppcheck appears to be fine with pcmk__realloc for me, but I would still be all for investigating removing it in favor of someone else's code.

With the recent TLS changes, I think we have all the pieces in place and this should be a simple matter of gluing them together. Most everything in remote CIB admin/Pacemaker Remote gnutls connection management land is pretty well broken into functions now. It might simply be a matter of passing the right cred_type around - it's probably more work to check the environment or command line (or whatever) to decide what connection type it is than it will be to actually implement this.