untrusted comment: verify with openbsd-80-base.pub
RWSMSt0erHTctSDjUFZodU70LIvhsE4lvg3IpfyeEVr34IfHyhOjFQooXklB97vU0rJ8hOJa1aFhE27RGh+UsQu7n2rYkEIWog0=

OpenBSD 8.0 errata 017, November 14, 2026:

A race in TCP syn cache could crash the kernel remotely.

Apply by doing:
    signify -Vep /etc/signify/openbsd-80-base.pub -x 017_tcpsyn.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/netinet/tcp_input.c
===================================================================
RCS file: /cvs/src/sys/netinet/tcp_input.c,v
diff -u -p -r1.469 tcp_input.c
--- sys/netinet/tcp_input.c	18 Sep 2026 22:14:46 -0000	1.469
+++ sys/netinet/tcp_input.c	8 Nov 2026 12:59:00 -0000
@@ -3369,6 +3369,11 @@ syn_cache_timer(void *arg)
 	uint64_t now;
 	int lastref, do_ecn = 0;
 
+	/*
+	 * Routes in rt_timer are only protected by exclusive netlock.  Grab
+	 * shared netlock here to avoid that syn_cache_put() frees a route.
+	 */
+	NET_LOCK_SHARED();
 	mtx_enter(&syn_cache_mtx);
 	inp = in_pcbref(sc->sc_inplisten);
 	if (inp == NULL)
@@ -3397,7 +3402,6 @@ syn_cache_timer(void *arg)
 		refcnt_take(&sc->sc_refcnt);
 	mtx_leave(&syn_cache_mtx);
 
-	NET_LOCK_SHARED();
 	so = in_pcbsolock(inp);
 	if (so != NULL) {
 		now = tcp_now();
@@ -3408,10 +3412,10 @@ syn_cache_timer(void *arg)
 		tcpstat_inc(tcps_sc_retransmitted);
 	}
 	in_pcbsounlock(inp, so);
-	NET_UNLOCK_SHARED();
 
 	in_pcbunref(inp);
 	syn_cache_put(sc);
+	NET_UNLOCK_SHARED();
 	return;
 
  dropit:
@@ -3425,6 +3429,7 @@ syn_cache_timer(void *arg)
  freeit:
 	mtx_leave(&syn_cache_mtx);
 	syn_cache_put(sc);
+	NET_UNLOCK_SHARED();
 }
 
 /*