git: 5de6a55c70ba - releng/15.0 - rtsock: Fix stack overflow

The branch releng/15.0 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=5de6a55c70ba97c9bded822df449228065519ac0

commit 5de6a55c70ba97c9bded822df449228065519ac0
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-02-23 15:52:50 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-02-23 16:39:42 +0000

    rtsock: Fix stack overflow
    
    Approved by:    so
    Security:       FreeBSD-SA-26:05.route
    Security:       CVE-2026-3038
    Fixes:          92be2847e845 ("rtsock: Avoid copying uninitialized padding bytes")
---
 sys/net/rtsock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index f0dcc973ca7c..42be9b174972 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -1866,8 +1866,8 @@ rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo, struct walkarg *w, int *
 #endif
 			dlen = SA_SIZE(sa);
 		if (cp != NULL && buflen >= dlen) {
-			KASSERT(dlen <= sizeof(ss),
-			    ("%s: sockaddr size overflow", __func__));
+			if (sa->sa_len > sizeof(ss))
+				return (EINVAL);
 			bzero(&ss, sizeof(ss));
 			bcopy(sa, &ss, sa->sa_len);
 			sa = (struct sockaddr *)&ss;