kern/57163: IPv6 route MTU handled any more

[bouyer%antioche.eu.org@localhost]

>Number:         57163
>Category:       kern
>Synopsis:       IPv6 route MTU handled any more
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jan 05 19:25:00 +0000 2023
>Originator:     Manuel Bouyer
>Release:        NetBSD 10.0_BETA
>Organization:
>Environment:
System: NetBSD rochebonne.antioche.eu.org 10.0_BETA NetBSD 10.0_BETA (GENERIC_CAN) #0: Wed Jan 4 16:41:59 MET 2023 bouyer%armandeche.soc.lip6.fr@localhost:/local/armandeche1/tmp/build/amd64/obj/local/armandeche2/netbsd-10/src/sys/arch/amd64/compile/GENERIC_CAN amd64
Architecture: x86_64
Machine: amd64
>Description:
	I have a pppoe over ADSL connection at home, with an MTU of 1492.
	The router advertises IPv6 with an MTU of 1492, per rtadvd.conf:
default:\
	:chlim#64:raflags#0:rltime#1800:rtime#30000:retrans#1000:\
	:pinfoflags#192:vltime#3600000:pltime#3600000:mtu#1492:

	The client properly get its default route with the right MTU:
rochebonne# netstat -rn -f inet6 |grep default
default                                 fe80::4a:6ff:fe41:9271         UG          -        -   1492  alc0

	This works fine with 9.x clients.
	But since I upgraded one client to 10.0_BETA TCP connections from this
	client stall when receiving large amount of data. tcpdump shows:
20:19:19.339688 IP6 (flowlabel 0xdfd4b, hlim 50, next-header TCP (6) payload length: 28) 2001:41d0:fe9d:1100:96de:80ff:fe21:bec0.65449 > 2001:660:3302:282a:204:75ff:fe9f:9e11.80: Flags [S], cksum 0x4100 (correct), seq 1784052849, win 32768, options [mss 1440,sackOK,eol], length 0

	that is, the client adverstises a MSS of 1440 instead of 1432.
>How-To-Repeat:
	setup a IPv6 default route with MTU lower than the interface's MTU.
	Notice that the TCP mss sent on connection is too large.
>Fix:
	please