untrusted comment: verify with openbsd-79-base.pub
RWTSdNN9A3yvWMF1nBJvm1CbSMKFHyw3p6AcyL/pvxfVhcaX7cQ57Ki2RkIkhx3mE8GTw/507XQvEEe1y8BlzKnwNQ44kvn+bg8=

OpenBSD 7.9 errata 053, November 14, 2026:

A race in IPv6 duplicate address detection could corrupt kernel
memory.

Apply by doing:
    signify -Vep /etc/signify/openbsd-79-base.pub -x 053_nd6dad.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/netinet6/nd6_nbr.c
===================================================================
RCS file: /cvs/src/sys/netinet6/nd6_nbr.c,v
diff -u -p -r1.165 nd6_nbr.c
--- sys/netinet6/nd6_nbr.c	16 Sep 2025 09:52:49 -0000	1.165
+++ sys/netinet6/nd6_nbr.c	8 Nov 2026 16:19:43 -0000
@@ -1010,7 +1010,7 @@ nd6_dad_reaper(void *arg)
 void
 nd6_dad_starttimer(struct dadq *dp)
 {
-	timeout_set_proc(&dp->dad_timer_ch, nd6_dad_timer, dp->dad_ifa);
+	timeout_set_proc(&dp->dad_timer_ch, nd6_dad_timer, dp);
 	timeout_add_msec(&dp->dad_timer_ch, RETRANS_TIMER);
 }
 
@@ -1099,23 +1099,22 @@ nd6_dad_stop(struct ifaddr *ifa)
 void
 nd6_dad_timer(void *arg)
 {
-	struct ifaddr *ifa = arg;
+	struct dadq *dp = arg;
+	struct ifaddr *ifa;
 	struct in6_ifaddr *ia6;
 	struct in6_addr daddr6, taddr6;
 	struct ifnet *ifp;
-	struct dadq *dp;
 	char addr[INET6_ADDRSTRLEN];
 
 	NET_LOCK();
 
+	ifa = dp->dad_ifa;
+	if (nd6_dad_find(ifa) != dp)
+		goto done;
+
 	ia6 = ifatoia6(ifa);
 	taddr6 = ia6->ia_addr.sin6_addr;
 	ifp = ifa->ifa_ifp;
-	dp = nd6_dad_find(ifa);
-	if (dp == NULL) {
-		log(LOG_ERR, "%s: DAD structure not found\n", __func__);
-		goto done;
-	}
 	if (ia6->ia6_flags & IN6_IFF_DUPLICATED) {
 		log(LOG_ERR, "%s: called with duplicated address %s(%s)\n",
 		    __func__, inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr,