untrusted comment: verify with openbsd-77-base.pub
RWSbCCUoGpcxVcF+zUNfEXVkpvQEdG6e27LykK2T6yxMu3uuWSawpPqx9wm0DZ5L9cNP6ug5MIMSUX3yOQpI095h5rfO+OVr6gk=

OpenBSD 7.7 errata 035, April 14, 2026:

rad(8) and slaacd(8) could spin doing nothing after a malformed packet.

Apply by doing:
    signify -Vep /etc/signify/openbsd-77-base.pub -x 035_v6daemons.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install slaacd and rad:
    cd /usr/src/sbin/slaacd
    make obj
    make
    make install
    cd /usr/src/usr.sbin/rad
    make obj
    make
    make install

Index: sbin/slaacd/engine.c
===================================================================
RCS file: /cvs/src/sbin/slaacd/engine.c,v
diff -u -p -u -r1.99 engine.c
--- sbin/slaacd/engine.c	21 Nov 2024 13:35:20 -0000	1.99
+++ sbin/slaacd/engine.c	12 Apr 2026 05:37:06 -0000
@@ -1474,6 +1474,8 @@ parse_ra(struct slaacd_iface *iface, str
 		struct in6_addr *in6;
 		int i;
 
+		if (nd_opt_hdr->nd_opt_len == 0)
+			goto err;
 		len -= sizeof(struct nd_opt_hdr);
 		p += sizeof(struct nd_opt_hdr);
 
@@ -1760,6 +1762,8 @@ debug_log_ra(struct imsg_ra *ra)
 		struct in6_addr *in6;
 		int i;
 
+		if (nd_opt_hdr->nd_opt_len == 0)
+			return;
 		len -= sizeof(struct nd_opt_hdr);
 		p += sizeof(struct nd_opt_hdr);
 		if (nd_opt_hdr->nd_opt_len * 8 - 2 > len) {
Index: usr.sbin/rad/engine.c
===================================================================
RCS file: /cvs/src/usr.sbin/rad/engine.c,v
diff -u -p -u -r1.28 engine.c
--- usr.sbin/rad/engine.c	21 Nov 2024 13:38:15 -0000	1.28
+++ usr.sbin/rad/engine.c	12 Apr 2026 05:37:06 -0000
@@ -533,6 +533,8 @@ parse_rs(struct imsg_ra_rs *rs)
 	while ((size_t)len >= sizeof(struct nd_opt_hdr)) {
 		struct nd_opt_hdr *nd_opt_hdr = (struct nd_opt_hdr *)p;
 
+		if (nd_opt_hdr->nd_opt_len == 0)
+			return;
 		len -= sizeof(struct nd_opt_hdr);
 		p += sizeof(struct nd_opt_hdr);
 
