git: pf: fix IPv6 fragment length checks

[Aaron LI]

commit cebb74e944ae70cb4eac1f76b3a3c7cf2502e7a6
Author: David Bidner <david at crap.solutions>
Date:   Sun Oct 4 14:54:38 2026 +0200

    pf: fix IPv6 fragment length checks
    
    ip6_plen excludes the IPv6 header, but off includes it. Check packet and
    fragment-header bounds, use matching length units, and reject misaligned
    non-final fragments. Include pre-fragment extension headers in the
    reassembled payload limit.
    
    Bug: https://bugs.dragonflybsd.org/issues/3437

Summary of changes:
 sys/net/pf/pf_norm.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/cebb74e944ae70cb4eac1f76b3a3c7cf2502e7a6


-- 
DragonFly BSD source repository