kern/60955: packet normalization crashes on stateful rules

["joe%eloisystems.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60955
>Category:       kern
>Synopsis:       packet normalization crashes on stateful rules
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Nov 02 13:45:00 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD current
>Organization:
NetBSD
>Environment:
tBSD  11.99.9 NetBSD 11.99.9 (GENERIC) #31: Sun Nov  1 20:57:38 UTC 2026 
>Description:
With npf normalization, setting a maxmss value on a stateful rule crashes the kernel.

stateless rules are fine.


here is a trace.

this was caught in adding more tests for rule procedures.

#4  0xffffffff8023d7fe in trap (frame=0xffffac815525f6e0)
    at /usr/current/src/sys/arch/amd64/amd64/trap.c:325
#5  0xffffffff80234ad4 in alltraps ()
#6  0xffffffff80bb66ea in npf_fetch_tcpopts (npc=npc@entry=0xffffac815525f988, 
    mss=mss@entry=0x0, wscale=wscale@entry=0xffff9022470ad090)
    at /usr/current/src/sys/net/npf/npf_inet.c:294
#7  0xffffffff80bbb30e in npf_tcp_inwindow (npc=0xffffac815525f988, 
    nst=0xffff9022470ad080, flow=NPF_FLOW_FORW)
    at /usr/current/src/sys/net/npf/npf_state_tcp.c:358
#8  npf_state_tcp (npc=npc@entry=0xffffac815525f988, 
    nst=nst@entry=0xffff9022470ad080, flow=flow@entry=NPF_FLOW_FORW)
    at /usr/current/src/sys/net/npf/npf_state_tcp.c:478
#9  0xffffffff80bbad4f in npf_state_init (npc=npc@entry=0xffffac815525f988, 
    nst=nst@entry=0xffff9022470ad080)
--Type <RET> for more, q to quit, c to continue without paging--
    at /usr/current/src/sys/net/npf/npf_state.c:158
#10 0xffffffff80bb7f18 in npf_conn_establish (
    npc=npc@entry=0xffffac815525f988, di=di@entry=2, global=true)
    at /usr/current/src/sys/net/npf/npf_conn.c:461
#11 0xffffffff80baf5ea in npfk_packet_handler (npf=0xffff902242588800, 
    mp=0xffffac815525fa50, ifp=<optimized out>, di=2)
>How-To-Repeat:
procedure "norm" {
        normalize : "max-mss" 1321
}


group "ext" on wm0 {
        pass stateful out all apply "norm"
}

group default {
        pass all
}
>Fix:

Yes, fix to be submitted soon!