git: f3be7df50f01 - main - rtsock: Fix stack overflow

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=f3be7df50f01d9a6ead9f27b55bb4dfd7dc4f9d2

commit f3be7df50f01d9a6ead9f27b55bb4dfd7dc4f9d2
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-02-23 15:52:50 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-02-24 15:58:48 +0000

    rtsock: Fix stack overflow
    
    Approved by:    so
    Security:       FreeBSD-SA-26:05.route
    Security:       CVE-2026-3038
    Fixes:          92be2847e845 ("rtsock: Avoid copying uninitialized padding bytes")
---
 sys/net/rtsock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index 774537366910..5251d4d75f15 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -1875,8 +1875,8 @@ rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo, struct walkarg *w, int *
 #endif
 			dlen = SA_SIZE(sa);
 		if (cp != NULL && buflen >= dlen) {
-			KASSERT(dlen <= sizeof(ss),
-			    ("%s: sockaddr size overflow", __func__));
+			if (sa->sa_len > sizeof(ss))
+				return (EINVAL);
 			bzero(&ss, sizeof(ss));
 			bcopy(sa, &ss, sa->sa_len);
 			sa = (struct sockaddr *)&ss;