There is something missing in wolfSSL_Read, there is no MSG_PEEK function, which causes this to be syntactically different than standard socket_read(  , MSG_PEEK) which allows for getting the first bytes of the pending income stream without advancing the internal byte poniter

Here is my new version of wolfSSL_read() -> ReceiveData( ) in internal.c

Set the sz value to a negative < 0 value and it will PEEK without changing the internal
buffer pointer

int ReceiveData(CYASSL* ssl, byte* output, int sz)
{
        int size;
        int peek = 0 ;

        CYASSL_ENTER("ReceiveData()");

        if (ssl->error == WANT_READ)
                ssl->error = 0;

        if (ssl->options.handShakeState != HANDSHAKE_DONE) {
                int err;
                CYASSL_MSG("Handshake not complete, trying to finish");
                if ( (err = CyaSSL_negotiate(ssl)) != 0)
                        return  err;
        }

        while (ssl->buffers.clearOutputBuffer.length == 0)
                if ( (ssl->error = ProcessReply(ssl)) < 0) {
                        CYASSL_ERROR(ssl->error);
                        if (ssl->error == ZERO_RETURN) {
                                CYASSL_MSG("Zero return, no more data coming");
                                ssl->options.isClosed = 1;
                                return 0;         /* no more data coming */
                        }
                        if (ssl->error == SOCKET_ERROR_E) {
                                if (ssl->options.connReset || ssl->options.isClosed) {
                                        CYASSL_MSG("Peer reset or closed, connection done");
                                        return 0;     /* peer reset or closed */
                                }
                        }
                        return ssl->error;
                }

        if (sz < 0)
        {
            //We are peeking at the data
            peek = 1 ;
            //Flip the size back to a positive value
            sz = sz * -1 ;
        }

        if (sz < (int)ssl->buffers.clearOutputBuffer.length)
                size = sz;
        else
                size = ssl->buffers.clearOutputBuffer.length;

        XMEMCPY(output, ssl->buffers.clearOutputBuffer.buffer, size);

        if (peek == 0)
        {
            ssl->buffers.clearOutputBuffer.length -= size;
            ssl->buffers.clearOutputBuffer.buffer += size;
        }

        if (ssl->buffers.clearOutputBuffer.length == 0 &&
                                                                                     ssl->buffers.inputBuffer.dynamicFlag)
             ShrinkInputBuffer(ssl, NO_FORCED_FREE);

        CYASSL_LEAVE("ReceiveData()", size);
        return size;
}