untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWU8EyUjKN2oa/IhuIh7vW8bSM6CDLesgVi9VPezuTz8Gvr1folKGncGSdxVB84OSVIc23DIjJr5JFfWGdz1RHwU=

OpenBSD 7.8 errata 029, April 14, 2026:

rad(8) and slaacd(8) could spin doing nothing after a malformed packet.

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 029_v6daemons.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install slaacd and rad:
    cd /usr/src/sbin/slaacd
    make obj
    make
    make install
    cd /usr/src/usr.sbin/rad
    make obj
    make
    make install

Index: sbin/slaacd/engine.c
===================================================================
RCS file: /cvs/src/sbin/slaacd/engine.c,v
diff -u -p -u -r1.99 engine.c
--- sbin/slaacd/engine.c	21 Nov 2024 13:35:20 -0000	1.99
+++ sbin/slaacd/engine.c	12 Apr 2026 05:38:15 -0000
@@ -1474,6 +1474,8 @@ parse_ra(struct slaacd_iface *iface, str
 		struct in6_addr *in6;
 		int i;
 
+		if (nd_opt_hdr->nd_opt_len == 0)
+			goto err;
 		len -= sizeof(struct nd_opt_hdr);
 		p += sizeof(struct nd_opt_hdr);
 
@@ -1760,6 +1762,8 @@ debug_log_ra(struct imsg_ra *ra)
 		struct in6_addr *in6;
 		int i;
 
+		if (nd_opt_hdr->nd_opt_len == 0)
+			return;
 		len -= sizeof(struct nd_opt_hdr);
 		p += sizeof(struct nd_opt_hdr);
 		if (nd_opt_hdr->nd_opt_len * 8 - 2 > len) {
Index: usr.sbin/rad/engine.c
===================================================================
RCS file: /cvs/src/usr.sbin/rad/engine.c,v
diff -u -p -u -r1.29 engine.c
--- usr.sbin/rad/engine.c	27 Apr 2025 16:23:04 -0000	1.29
+++ usr.sbin/rad/engine.c	12 Apr 2026 05:38:15 -0000
@@ -541,6 +541,8 @@ parse_rs(struct imsg_ra_rs *rs)
 	while ((size_t)len >= sizeof(struct nd_opt_hdr)) {
 		struct nd_opt_hdr *nd_opt_hdr = (struct nd_opt_hdr *)p;
 
+		if (nd_opt_hdr->nd_opt_len == 0)
+			return;
 		len -= sizeof(struct nd_opt_hdr);
 		p += sizeof(struct nd_opt_hdr);