git: 73bd8d4bf618 - main - pf: fix DIOCXBEING/DIOCXROLLBACK/DIOCXCOMMIT error handling

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=73bd8d4bf618a5d6f4a2aa7f5237af3a5d8c1ebc

commit 73bd8d4bf618a5d6f4a2aa7f5237af3a5d8c1ebc
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-11-02 10:19:31 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-11-02 12:40:02 +0000

    pf: fix DIOCXBEING/DIOCXROLLBACK/DIOCXCOMMIT error handling
    
     - ensure the anchor name is always 0-terminated
       strlcpy() won't overflow, but will walk off the end of the provided
       buffer looking for a 0.
     - don't overwrite the pf_begin()/... return value with the copyout()
       return value
     - stop on the first copyout() error
    
    Fixes:  2636cc0414fd (pf: have DIOCXBEGIN/DIOCXROLLBACK/DIOCXCOMMIT use the new functions, 2026-10-27)
    Reported by:    markj's Post-Commit LLM Review Service
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf_ioctl.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 3dda0a17754d..36308c466843 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -6392,6 +6392,7 @@ DIOCCHANGEADDR_error:
 			e = malloc(sizeof(*e), M_PF, M_WAITOK);
 
 			e->rs_num = ie.rs_num;
+			ie.anchor[sizeof(ie.anchor) - 1] = '\0';
 			strlcpy(e->anchor, ie.anchor, sizeof(e->anchor));
 			e->ticket = ie.ticket;
 
@@ -6410,10 +6411,18 @@ DIOCCHANGEADDR_error:
 			break;
 		}
 
+		if (error != 0) {
+			pf_trans_free(&trans);
+			break;
+		}
+
 		i = 0;
 		TAILQ_FOREACH(e, &trans.elms, entry) {
-			error = copyout(&e->ticket, &io->array[i].ticket, sizeof(e->ticket));
+			error = copyout(&e->ticket, &io->array[i].ticket,
+			    sizeof(e->ticket));
 			i++;
+			if (error)
+				break;
 		}
 
 		pf_trans_free(&trans);