git: 1f5b1de1fdf2 - main - ipv6: account for jumbo payload option

The branch main has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=1f5b1de1fdf2924066c1851ed6c73f36fe20b438

commit 1f5b1de1fdf2924066c1851ed6c73f36fe20b438
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2026-01-16 11:49:40 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2026-01-16 11:49:40 +0000

    ipv6: account for jumbo payload option
    
    If a jumbo payload option is added, the length of the mbuf chain is
    increased by 8 but the actual hop-by-hop extension header with the
    jumbo playload option is only inserted in the packet if there are
    other options. Therefore, adjust optlen to reflect the actual size
    of IPv6 extension headers including the hop-by-hop extension header
    containing the jumbo payload option.
    
    Reported by:            syzbot+73fe316271df473230eb@syzkaller.appspotmail.com
    Reviewed by:            markj, Timo Voelker
    MFC after:              3 days
    Differential Revision:  https://reviews.freebsd.org/D54394
---
 sys/netinet6/ip6_output.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index eb5a3a971ea0..d61bc983cc12 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -556,6 +556,7 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
 			goto freehdrs;
 		ip6->ip6_plen = 0;
+		optlen += 8; /* JUMBOOPTLEN */
 	} else
 		ip6->ip6_plen = htons(plen);
 	nexthdrp = &ip6->ip6_nxt;