Re: kern/60491: arp creates state for invalid messages

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

Can you please try running with the attached patch to reveal some
additional information about the mbuf before m_makewritable next time
it crashes?  Trying to find what initial conditions might lead
m_makewritable to prepend an empty mbuf link in the chain.

Can you also share dmesg output at boot?  Do you know which NIC driver
the ethernet frame came in via?

diff -r 346a58589b6e sys/netinet/if_arp.c
--- a/sys/netinet/if_arp.c	Sun Mar 30 14:17:08 2025 +0000
+++ b/sys/netinet/if_arp.c	Mon Nov 09 16:51:35 2026 +0000
@@ -794,11 +794,27 @@ in_arpinput(struct mbuf *m)
 	char ipbuf[INET_ADDRSTRLEN];
 	bool find_source, do_dad;
 
+	int om_lead = M_LEADINGSPACE(m);
+	int om_trail = M_TRAILINGSPACE(m);
+	struct mbuf *om_ptr = m, om_snapshot = *m, *om = &om_snapshot;
 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
 		goto out;
+
 	ah = mtod(m, struct arphdr *);
 	op = ntohs(ah->ar_op);
-	KASSERT(op == ARPOP_REPLY || op == ARPOP_REQUEST);
+	KASSERTMSG(op == ARPOP_REPLY || op == ARPOP_REQUEST,
+	    "op=0x%04x"
+	    " om=%p"
+	    " om->m_flags=0x%x om->m_data=%p om->m_len=%d om->m_next=%p om->m_pkthdr.len=%d"
+	    " M_LEADINGSPACE(om)=%d M_TRAILINGSPACE(om)=%d"
+	    " m=%p"
+	    " m->m_flags=0x%x m->m_data=%p m->m_len=%d m->m_next=%p m->m_pkthdr.len=%d"
+	    " M_LEADINGSPACE(m)=%d M_TRAILINGSPACE(m)=%d",
+	    op,
+	    om_ptr, om->m_flags, om->m_data, om->m_len, om->m_next, om->m_pkthdr.len,
+	    om_lead, om_trail,
+	    m, m->m_flags, m->m_data, m->m_len, m->m_next, m->m_pkthdr.len,
+	    (int)M_LEADINGSPACE(m), (int)M_TRAILINGSPACE(m));
 
 	if (ah->ar_pln != sizeof(struct in_addr))
 		goto out;