git: d143c08f88ca - stable/14 - ppp: Don't fetch a non-existent variadic argument

The branch stable/14 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=d143c08f88ca91d5280e26399daf94d7636b7779

commit d143c08f88ca91d5280e26399daf94d7636b7779
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-06-10 13:44:10 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 18:23:13 +0000

    ppp: Don't fetch a non-existent variadic argument
    
    Only fetch the optional mode argument to ID0open to pass to open(2) if
    O_CREAT is present in the flags argument.  It is UB to fetch an
    argument that doesn't exist.  On CHERI this UB results in a fault.
    
    Reviewed by:    brooks
    Obtained from:  CheriBSD
    Sponsored by:   AFRL, DARPA
    Differential Revision:  https://reviews.freebsd.org/D57137
    
    (cherry picked from commit b5a8b933d4994835e10226562ff8126298c96693)
---
 usr.sbin/ppp/id.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/usr.sbin/ppp/id.c b/usr.sbin/ppp/id.c
index 5dd98cfee024..015218184b23 100644
--- a/usr.sbin/ppp/id.c
+++ b/usr.sbin/ppp/id.c
@@ -145,7 +145,10 @@ ID0open(const char *path, int flags, ...)
 
   va_start(ap, flags);
   ID0set0();
-  ret = open(path, flags, va_arg(ap, int));
+  if (flags & O_CREAT)
+	  ret = open(path, flags, va_arg(ap, int));
+  else
+	  ret = open(path, flags);
   log_Printf(LogID0, "%d = open(\"%s\", %d)\n", ret, path, flags);
   ID0setuser();
   va_end(ap);