Re: kern/60491: arp creates state for invalid messages

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

Can you please try to reproduce it with the attached patch?  Should
help to narrow down where things are going wrong.

# HG changeset patch
# User Taylor R Campbell <riastradh%NetBSD.org@localhost>
# Date 1792164105 0
#      Fri Oct 16 15:21:45 2026 +0000
# Branch trunk
# Node ID adab6b9c88cde7ef98ff7436dc06bece8350063f
# Parent  8fabf8640a9ac16011ccfe817764973287f81e77
# EXP-Topic riastradh-pr60491-arpvalidation
WIP: if_arp: Add diagnostics for crash.

PR kern/60491: arp creates state for invalid messages

diff -r 8fabf8640a9a -r adab6b9c88cd sys/netinet/if_arp.c
--- a/sys/netinet/if_arp.c	Thu Oct 08 00:06:04 2026 +0000
+++ b/sys/netinet/if_arp.c	Fri Oct 16 15:21:45 2026 +0000
@@ -742,6 +742,8 @@ arpintr(void *arg __unused)
 				ARP_STATINC(ARP_STAT_RCVBADPROTO);
 				goto free;
 			}
+			KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+			    ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
 			in_arpinput(m);
 			continue;
 		default:
@@ -794,6 +796,8 @@ in_arpinput(struct mbuf *m)
 	char ipbuf[INET_ADDRSTRLEN];
 	bool find_source, do_dad;
 
+	KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+	    ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
 		goto out;
 	ah = mtod(m, struct arphdr *);
@@ -1895,7 +1899,11 @@ in_revarpinput(struct mbuf *m)
 	switch (op) {
 	case ARPOP_REQUEST:
 	case ARPOP_REPLY:	/* per RFC */
+		KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+		    ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
 		m_put_rcvif(rcvif, &s);
+		KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REPLY ||
+		    ntohs(mtod(m, struct arphdr *)->ar_op) == ARPOP_REQUEST);
 		in_arpinput(m);
 		return;
 	case ARPOP_REVREPLY: