untrusted comment: verify with openbsd-79-base.pub
RWTSdNN9A3yvWDDieZMyeO0SRr1cL3CALQAiKE2C8Y/YUVy6f/+8fyNXnDRcn41eRwILlvuwEggStn5VtSagFXnkP9uTLCxZnAs=

OpenBSD 7.9 errata 051, November 14, 2026:

TCP SACK packets could crash the kernel remotely.

Apply by doing:
    signify -Vep /etc/signify/openbsd-79-base.pub -x 051_tcpsack.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/netinet/tcp_output.c
===================================================================
RCS file: /cvs/src/sys/netinet/tcp_output.c,v
diff -u -p -r1.158 tcp_output.c
--- sys/netinet/tcp_output.c	1 Jan 2026 05:28:23 -0000	1.158
+++ sys/netinet/tcp_output.c	8 Nov 2026 10:06:46 -0000
@@ -306,9 +306,8 @@ again:
 		}
 	}
 
-	if (!sack_rxmit) {
+	if (!sack_rxmit)
 		len = ulmin(so->so_snd.sb_cc, win) - off;
-	}
 
 	if (len < 0) {
 		/*
@@ -347,7 +346,7 @@ again:
 		    ((tp->t_flags & TF_SIGNATURE) == 0) &&
 #endif
 		    len >= 2 * tp->t_maxseg &&
-		    tp->rcv_numsacks == 0 && sack_rxmit == 0 &&
+		    tp->rcv_numsacks == 0 && !sack_rxmit &&
 		    !(flags & (TH_SYN|TH_RST|TH_FIN))) {
 			tso = 1;
 			/* avoid small chopped packets */
@@ -931,11 +930,8 @@ send:
 				tp->t_flags |= TF_SENTFIN;
 			}
 		}
-		if (tp->sack_enable) {
-			if (sack_rxmit && (p->rxmit != tp->snd_nxt)) {
-				goto timer;
-			}
-		}
+		if (sack_rxmit)
+			goto timer;
 		tp->snd_nxt += len;
 		if (SEQ_GT(tp->snd_nxt, tp->snd_max)) {
 			tp->snd_max = tp->snd_nxt;
@@ -959,7 +955,7 @@ send:
 		 * of retransmit time.
 		 */
  timer:
-		if (tp->sack_enable && sack_rxmit &&
+		if (sack_rxmit &&
 		    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
 		    tp->snd_nxt != tp->snd_max) {
 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);