NetBSD Problem Report #60491
From www@netbsd.org Thu Jul 23 20:56:59 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 8801F1A923B
for <gnats-bugs@gnats.NetBSD.org>; Thu, 23 Jul 2026 20:56:59 +0000 (UTC)
Message-Id: <20260723205658.48EC51A923C@mollari.NetBSD.org>
Date: Thu, 23 Jul 2026 20:56:58 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: arp creates state for invalid messages
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>
>Number: 60491
>Category: kern
>Synopsis: arp creates state for invalid messages
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: needs-pullups
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Thu Jul 23 21:00:00 +0000 2026
>Closed-Date:
>Last-Modified: Wed Oct 28 15:00:01 +0000 2026
>Originator: Taylor R Campbell
>Release:
>Organization:
The NetBSD Addressolution, Invalid
>Environment:
>Description:
The arp input path doesn't validate the op until after it has
allocated memory and stored state for the message, causing the
kernel to waste memory and report invalid arp entries to the
system.
Forwarded to us by Chris Jarrett-Davies <chrisjd@openai.com>.
>How-To-Repeat:
send arp packets with bogus op fields
>Fix:
validate earlier on in arpintr or ip_arpinput
>Release-Note:
>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60491 CVS commit: src/sys/netinet
Date: Thu, 23 Jul 2026 21:49:19 +0000
Module Name: src
Committed By: riastradh
Date: Thu Jul 23 21:49:19 UTC 2026
Modified Files:
src/sys/netinet: if_arp.c
Log Message:
arp: Validate op on input, before creating any state.
PR kern/60491: arp creates state for invalid messages
To generate a diff of this commit:
cvs rdiff -u -r1.320 -r1.321 src/sys/netinet/if_arp.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 23 Jul 2026 22:10:04 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, pullup-9
From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Cc:
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Fri, 16 Oct 2026 15:16:30 +0000
This is a multi-part message in MIME format.
--=_Jk88w0qeZbZBxabcXkD5GbHSqAbVNpLw
Fixxy bug, buggy fix...
--=_Jk88w0qeZbZBxabcXkD5GbHSqAbVNpLw
Content-Type: message/rfc822
Content-Disposition: inline
Date: Fri, 16 Oct 2026 15:57:15 +0200
From: Thomas Klausner <wiz@netbsd.org>
To: Taylor R Campbell <riastradh@netbsd.org>
Cc: current-users@netbsd.org
Subject: Re: CVS commit: src/sys/netinet
Message-ID: <atIsrv9rvTBqnr6s@exadelic.gatalith.at>
In-Reply-To: <20260723214919.6E9F5F99A@cvs.NetBSD.org>
References: <20260723214919.6E9F5F99A@cvs.NetBSD.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
On Thu, Jul 23, 2026 at 09:49:19PM +0100, Taylor R Campbell wrote:
> Module Name: src
> Committed By: riastradh
> Date: Thu Jul 23 21:49:19 UTC 2026
>
> Modified Files:
> src/sys/netinet: if_arp.c
>
> Log Message:
> arp: Validate op on input, before creating any state.
>
> PR kern/60491: arp creates state for invalid messages
I just had a panic triggered by this message:
kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/usr/src/sys/netinet/if_arp.c", line 801
I have never seen this one before.
The only unusual thing I had going was a qemu with NetBSD downloading
pkgsrc (via a tap bridge).
A core dump is available.
Thomas
>
> To generate a diff of this commit:
> cvs rdiff -u -r1.320 -r1.321 src/sys/netinet/if_arp.c
>
> Please note that diffs are not public domain; they are subject to the
> copyright notices on the relevant files.
>
> Modified files:
>
> Index: src/sys/netinet/if_arp.c
> diff -u src/sys/netinet/if_arp.c:1.320 src/sys/netinet/if_arp.c:1.321
> --- src/sys/netinet/if_arp.c:1.320 Fri May 29 02:45:14 2026
> +++ src/sys/netinet/if_arp.c Thu Jul 23 21:49:19 2026
> @@ -1,4 +1,4 @@
> -/* $NetBSD: if_arp.c,v 1.320 2026/05/29 02:45:14 ozaki-r Exp $ */
> +/* $NetBSD: if_arp.c,v 1.321 2026/07/23 21:49:19 riastradh Exp $ */
>
> /*
> * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
> @@ -68,7 +68,7 @@
> */
>
> #include <sys/cdefs.h>
> -__KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.320 2026/05/29 02:45:14 ozaki-r Exp $");
> +__KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.321 2026/07/23 21:49:19 riastradh Exp $");
>
> #ifdef _KERNEL_OPT
> #include "opt_ddb.h"
> @@ -734,6 +734,14 @@ arpintr(void *arg __unused)
> switch (ntohs(ar->ar_pro)) {
> case ETHERTYPE_IP:
> case ETHERTYPE_IPTRAILERS:
> + switch (ntohs(ar->ar_op)) {
> + case ARPOP_REQUEST:
> + case ARPOP_REPLY:
> + break;
> + default:
> + ARP_STATINC(ARP_STAT_RCVBADPROTO);
> + goto free;
> + }
> in_arpinput(m);
> continue;
> default:
> @@ -790,6 +798,7 @@ in_arpinput(struct mbuf *m)
> goto out;
> ah = mtod(m, struct arphdr *);
> op = ntohs(ah->ar_op);
> + KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);
>
> if (ah->ar_pln != sizeof(struct in_addr))
> goto out;
> @@ -1112,8 +1121,8 @@ reply:
> la = NULL;
> }
> if (op != ARPOP_REQUEST) {
> - if (op == ARPOP_REPLY)
> - ARP_STATINC(ARP_STAT_RCVREPLY);
> + KASSERT(op == ARPOP_REPLY);
> + ARP_STATINC(ARP_STAT_RCVREPLY);
> goto out;
> }
> ARP_STATINC(ARP_STAT_RCVREQUEST);
>
--=_Jk88w0qeZbZBxabcXkD5GbHSqAbVNpLw--
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Thomas Klausner <wiz@NetBSD.org>,
Manuel Bouyer <bouyer@antioche.eu.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Fri, 16 Oct 2026 15:23:01 +0000
This is a multi-part message in MIME format.
--=_tVq9BOFzAnpXS9N5Qy8XBZQoi+hFOgDk
Can you please try to reproduce it with the attached patch? Should
help to narrow down where things are going wrong.
--=_tVq9BOFzAnpXS9N5Qy8XBZQoi+hFOgDk
Content-Type: text/plain; charset="ISO-8859-1"; name="pr60491-arpcrashdiag"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="pr60491-arpcrashdiag.patch"
# HG changeset patch
# User Taylor R Campbell <riastradh@NetBSD.org>
# Date 1792164105 0
# Fri Oct 16 15:21:45 2026 +0000
# Branch trunk
# Node ID adab6b9c88cde7ef98ff7436dc06bece8350063f
# Parent 8fabf8640a9ac16011ccfe817764973287f81e77
# EXP-Topic riastradh-pr60491-arpvalidation
WIP: if_arp: Add diagnostics for crash.
PR kern/60491: arp creates state for invalid messages
diff -r 8fabf8640a9a -r adab6b9c88cd sys/netinet/if_arp.c
--- a/sys/netinet/if_arp.c Thu Oct 08 00:06:04 2026 +0000
+++ b/sys/netinet/if_arp.c Fri Oct 16 15:21:45 2026 +0000
@@ -742,6 +742,8 @@ arpintr(void *arg __unused)
ARP_STATINC(ARP_STAT_RCVBADPROTO);
goto free;
}
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
in_arpinput(m);
continue;
default:
@@ -794,6 +796,8 @@ in_arpinput(struct mbuf *m)
char ipbuf[INET_ADDRSTRLEN];
bool find_source, do_dad;
=20
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
goto out;
ah =3D mtod(m, struct arphdr *);
@@ -1895,7 +1899,11 @@ in_revarpinput(struct mbuf *m)
switch (op) {
case ARPOP_REQUEST:
case ARPOP_REPLY: /* per RFC */
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
m_put_rcvif(rcvif, &s);
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
in_arpinput(m);
return;
case ARPOP_REVREPLY:
--=_tVq9BOFzAnpXS9N5Qy8XBZQoi+hFOgDk--
From: Manuel Bouyer <bouyer@antioche.eu.org>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: Thomas Klausner <wiz@NetBSD.org>, gnats-bugs@NetBSD.org,
netbsd-bugs@NetBSD.org
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Fri, 16 Oct 2026 18:19:38 +0200
On Fri, Oct 16, 2026 at 03:23:01PM +0000, Taylor R Campbell wrote:
> Can you please try to reproduce it with the attached patch? Should
> help to narrow down where things are going wrong.
I built a kernel with this patch and rebooted. Let see if we get a
panic ...
--
Manuel Bouyer <bouyer@antioche.eu.org>
NetBSD: 26 ans d'experience feront toujours la difference
--
From: Manuel Bouyer <bouyer@antioche.eu.org>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org,
campbell+netbsd@mumble.net
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Sun, 18 Oct 2026 12:27:57 +0200
On Fri, Oct 16, 2026 at 04:20:02PM +0000, Manuel Bouyer via gnats wrote:
> I built a kernel with this patch and rebooted. Let see if we get a
> panic ...
We got a panic:
login: [ 120230.6352646] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 805
[ 120230.6878828] cpu0: Begin traceback...
[ 120230.6995794] vpanic() at netbsd:vpanic+0x18d
[ 120230.7062625] kern_assert() at netbsd:kern_assert+0x61
[ 120230.7278936] in_arpinput() at netbsd:in_arpinput+0x516
[ 120230.7459382] arpintr() at netbsd:arpintr+0x11c
[ 120230.7552529] softint_dispatch() at netbsd:softint_dispatch+0x124
[ 120230.7779701] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa380695cd0f0
[ 120230.7953966] Xsoftintr() at netbsd:Xsoftintr+0x4c
[ 120230.8159324] --- interrupt ---
[ 120230.8278898] 0:
[ 120230.8278898] cpu0: End traceback...
--
Manuel Bouyer <bouyer@antioche.eu.org>
NetBSD: 26 ans d'experience feront toujours la difference
--
From: Manuel Bouyer <bouyer@antioche.eu.org>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org,
campbell+netbsd@mumble.net
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Wed, 21 Oct 2026 16:00:52 +0200
On Sun, Oct 18, 2026 at 12:27:57PM +0200, Manuel Bouyer wrote:
> On Fri, Oct 16, 2026 at 04:20:02PM +0000, Manuel Bouyer via gnats wrote:
> > I built a kernel with this patch and rebooted. Let see if we get a
> > panic ...
>
> We got a panic:
> login: [ 120230.6352646] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 805
> [ 120230.6878828] cpu0: Begin traceback...
> [ 120230.6995794] vpanic() at netbsd:vpanic+0x18d
> [ 120230.7062625] kern_assert() at netbsd:kern_assert+0x61
> [ 120230.7278936] in_arpinput() at netbsd:in_arpinput+0x516
> [ 120230.7459382] arpintr() at netbsd:arpintr+0x11c
> [ 120230.7552529] softint_dispatch() at netbsd:softint_dispatch+0x124
> [ 120230.7779701] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa380695cd0f0
> [ 120230.7953966] Xsoftintr() at netbsd:Xsoftintr+0x4c
> [ 120230.8159324] --- interrupt ---
> [ 120230.8278898] 0:
> [ 120230.8278898] cpu0: End traceback...
I changed the KASSERT to KASSERTMSG to print op, and got:
login: [ 19315.2724722] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 805 op not REQUEST or REPLY: 65535
[ 19315.3281494] cpu0: Begin traceback...
[ 19315.3400271] vpanic() at netbsd:vpanic+0x18d
[ 19315.3529519] kern_assert() at netbsd:kern_assert+0x61
[ 19315.3624476] in_arpinput() at netbsd:in_arpinput+0x51d
[ 19315.3855787] arpintr() at netbsd:arpintr+0x11c
[ 19315.4025654] softint_dispatch() at netbsd:softint_dispatch+0x124
[ 19315.4134757] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffff8c80695cd0f0
[ 19315.4457469] Xsoftintr() at netbsd:Xsoftintr+0x4c
[ 19315.4531276] --- interrupt ---
The change is:
- KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);
+ KASSERTMSG(op == ARPOP_REPLY || op == ARPOP_REQUEST,
+ "op not REQUEST or REPLY: %d", op);
Looks like m_makewritable() may be at fault here.
--
Manuel Bouyer <bouyer@antioche.eu.org>
NetBSD: 26 ans d'experience feront toujours la difference
--
From: Manuel Bouyer <bouyer@antioche.eu.org>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org,
campbell+netbsd@mumble.net
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Wed, 28 Oct 2026 15:59:31 +0100
On Wed, Oct 21, 2026 at 04:00:52PM +0200, Manuel Bouyer wrote:
> [ 19315.4531276] --- interrupt ---
>
> The change is:
> - KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);
> + KASSERTMSG(op == ARPOP_REPLY || op == ARPOP_REQUEST,
> + "op not REQUEST or REPLY: %d", op);
>
> Looks like m_makewritable() may be at fault here.
Now running with this patch:
? sys/netinet/if_arp.c.assertmsg
? sys/netinet/if_arp.c.assertmsg2
Index: sys/netinet/if_arp.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/if_arp.c,v
retrieving revision 1.321
diff -u -p -u -r1.321 if_arp.c
--- sys/netinet/if_arp.c 23 Jul 2026 21:49:19 -0000 1.321
+++ sys/netinet/if_arp.c 28 Oct 2026 13:56:37 -0000
@@ -742,6 +742,8 @@ arpintr(void *arg __unused)
ARP_STATINC(ARP_STAT_RCVBADPROTO);
goto free;
}
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
in_arpinput(m);
continue;
default:
@@ -793,12 +795,16 @@ in_arpinput(struct mbuf *m)
int s;
char ipbuf[INET_ADDRSTRLEN];
bool find_source, do_dad;
+ struct mbuf *om = m;
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
goto out;
ah = mtod(m, struct arphdr *);
op = ntohs(ah->ar_op);
- KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);
+ KASSERTMSG(op == ARPOP_REPLY || op == ARPOP_REQUEST,
+ "op not REQUEST or REPLY: %d %p %p", op, m, om);
if (ah->ar_pln != sizeof(struct in_addr))
goto out;
@@ -1895,7 +1901,11 @@ in_revarpinput(struct mbuf *m)
switch (op) {
case ARPOP_REQUEST:
case ARPOP_REPLY: /* per RFC */
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
m_put_rcvif(rcvif, &s);
+ KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+ ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
in_arpinput(m);
return;
case ARPOP_REVREPLY:
I got this panic:
[ 603891.0584629] panic: kernel diagnostic assertion "op == ARPOP_REPLY || op == ARPOP_REQUEST" failed: file "/dsk/l1/misc/bouyer/HEAD/clean/src/sys/netinet/if_arp.c", line 806 op not REQUEST or REPLY: 65535 0xffff85ca8b4ff7e0 0xffff85ca73cdebc0
[ 603891.1323430] cpu0: Begin traceback...
[ 603891.1440383] vpanic() at netbsd:vpanic+0x18d
[ 603891.1584130] kern_assert() at netbsd:kern_assert+0x61
[ 603891.1722752] in_arpinput() at netbsd:in_arpinput+0x52c
[ 603891.1887326] arpintr() at netbsd:arpintr+0x11c
[ 603891.1995472] softint_dispatch() at netbsd:softint_dispatch+0x124
db{0}> show mbuf /v 0xffff85ca8b4ff7e0
MBUF(0) 0xffff85ca8b4ff7e0
data=0xffff85ca8b4ff850, len=0, type=1, flags=0x102<PKTHDR,BCAST>
owner=0x0, next=0xffff85ca73cdebc0, nextpkt=0x0
leadingspace=0, trailingspace=400, readonly=0
pktlen=46, rcvif=0xffff8f0001f66060, csum_flags=0, csum_data=0x0, segsz=0
ETHER: DST = 00:01:08:00:06:04
ETHER: SRC = 00:01:f4:cf:e2:d4
ETHER: TYPE = 0x4b00(unknown)
offset 0014: 84 e3 67 01
offset 0018: 00 00 00 00
offset 0022: 00 00 84 e3
offset 0026: 67 9e 00 00
offset 0030: 00 00 00 00
offset 0034: 00 00 00 00
offset 0038: 00 00 00 00
offset 0042: 00 00 00 00
db{0}> show mbuf /v 0xffff85ca73cdebc0
MBUF(0) 0xffff85ca73cdebc0
data=0xffff85ca73ac680e, len=46, type=1, flags=0x9000101<EXT,BCAST,EXT_CLUSTER
,EXT_RW>
owner=0x0, next=0x0, nextpkt=0x0
leadingspace=14, trailingspace=1988, readonly=0
ext_refcnt=1, ext_buf=0xffff85ca73ac6800, ext_size=2048, ext_free=0x0, ext_arg
=0x0
ETHER: DST = 00:01:08:00:06:04
ETHER: SRC = 00:01:f4:cf:e2:d4
ETHER: TYPE = 0x4b00(unknown)
offset 0014: 84 e3 67 01
offset 0018: 00 00 00 00
offset 0022: 00 00 84 e3
offset 0026: 67 9e 00 00
offset 0030: 00 00 00 00
offset 0034: 00 00 00 00
offset 0038: 00 00 00 00
offset 0042: 00 00 00 00
So it looks like that after m_makewritable(), we end up with a mbuf with no
data (len = 0), but which is chained with our old mbuf. But the data here don't
make much sense; these ethernet addresses are unknown on my network and
the ether type doesn't make sense either.
But if we look at 0xffff85ca73ac6800 (the start of the mbuf cluster area):
db{0}> x/x 0xffff85ca73ac6800
ffff85ca73ac6800: ffffffff
db{0}>
ffff85ca73ac6804: cff4ffff
db{0}>
ffff85ca73ac6808: 4bd4e2
db{0}>
ffff85ca73ac680c: 1000608
db{0}>
ffff85ca73ac6810: 4060008
db{0}>
ffff85ca73ac6814: cff40100
db{0}>
ffff85ca73ac6818: 4bd4e2
db{0}>
ffff85ca73ac681c: 167e384
db{0}>
ffff85ca73ac6820: 0
db{0}>
ffff85ca73ac6824: e3840000
This gives:
DST: ff:ff:ff:ff:ff:ff
SRC: f4:cf:e2:d4:4b:00 (this is a known address on my network)
ETYPE: 0x0806 (this is ETHERTYPE_ARP)
ar_hrd: 0001 (ARPHRD_ETHER)
This makes more sense if we assume fields after ETYPE have been overwritten
(we reached the area pointed to by mbuf->data)
I didn't look closely enough at m_makewritable() to explain how we could end
up in this situation.
Anyway I don't think we can use mtod() on a mbuf whose len is 0, and it doens't
looks like m_makewritable() garantees that the first mbuf will contain the
whole arp header.
--
Manuel Bouyer <bouyer@antioche.eu.org>
NetBSD: 26 ans d'experience feront toujours la difference
--
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home