git: fc33bbb02450 - main - nd6: Fix the array size in union nd_opts

From: Mark Johnston <markj_at_FreeBSD.org>
Date: Thu, 10 Sep 2026 09:28:35 UTC
The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=fc33bbb024502d2c90289ff4b62a8ec4d20df238

commit fc33bbb024502d2c90289ff4b62a8ec4d20df238
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-09-10 09:27:35 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-09-10 09:27:35 +0000

    nd6: Fix the array size in union nd_opts
    
    ND_OPT_ROUTE_INFO is 24, so an access of that index is technically out
    of bounds, though note that the per-option struct has an entry for this
    option.  Fix the array size to appease -fsanitize=array-bounds.
    
    Reviewed by:    pouria, glebius
    MFC after:      2 weeks
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D59392
---
 sys/netinet6/nd6.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netinet6/nd6.h b/sys/netinet6/nd6.h
index 8b00c2d4a339..d393353f6811 100644
--- a/sys/netinet6/nd6.h
+++ b/sys/netinet6/nd6.h
@@ -288,7 +288,7 @@ VNET_DECLARE(int, ip6_temp_regen_advance); /* seconds */
 #define	V_ip6_temp_regen_advance	VNET(ip6_temp_regen_advance)
 
 union nd_opts {
-	struct nd_opt_hdr *nd_opt_array[24];	/* max = ND_OPT_ROUTE_INFO */
+	struct nd_opt_hdr *nd_opt_array[25];	/* max = ND_OPT_ROUTE_INFO */
 	struct {
 		struct nd_opt_hdr *zero;
 		struct nd_opt_hdr *src_lladdr;