misc/60959: AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter while AES-XTS 512 with same parameters doesn't

["el%horse64.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60959
>Category:       misc
>Synopsis:       AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter while AES-XTS 512 with same parameters doesn't
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    misc-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 03 23:35:00 +0000 2026
>Originator:     Ellie
>Release:        
>Organization:
>Environment:
I sadly didn't capture the respective output when using the NetBSD 11.0 installer where I tested this in the rescue console, but here's the one after installing: NetBSD ruby-b-s-delly 11.0_STABLE NetBSD 11.0_STABLE (GENERIC) #0: Fri Oct 30 19:02:53 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
(Sorry if the category is wrong!)

AES-CBC 512 seems to bug out sometimes during cgdconfig -V re-enter, leading to an interesting wrong block size error. This is an example of a config that broke for me:

algorithm aes-cbc;
iv-method encblkno1;
keylength 512;
verify_method disklabel;
keygen pkcs5_pbkdf2/sha1 {
        iterations 3775370;
        salt AAAAgCGjG2AHyP0MjuDyMDWisNc=;
};

It gives an "ioctl: Invalid argument" when running cgdconfig -V re-enter, after a warning about a too large block size.

Meanwhile AES-XTS 512 with same parameters then worked;

algorithm aes-xts;
iv-method encblkno1;
keylength 512;
verify_method disklabel;
keygen pkcs5_pbkdf2/sha1 {
        iterations 3775370;
        salt AAAAgCGjG2AHyP0MjuDyMDWisNc=;
};

I don't know if there's something that I did wrong about this, but some other NetBSD users who looked at this seemed to encourage me in thinking it might be a bug. If it's not a bug, please feel free to close or ignore this!
>How-To-Repeat:
1. Put this into /etc/cgd/cgdroot.cfg or a similar config file:

algorithm aes-cbc;
iv-method encblkno1;
keylength 512;
verify_method disklabel;
keygen pkcs5_pbkdf2/sha1 {
        iterations 3775370;
        salt AAAAgCGjG2AHyP0MjuDyMDWisNc=;
};

2. Run: cgdconfig -V re-enter cgd0 NAME=cgdroot /etc/cgdroot/cgdroot.cfg and enter some test password. It should fail with "ioctl: Invalid argument".
>Fix: