Thank you for reviewing. > 3 comments from AI: > > - The software checksum reads the header before validating its length. > A truncated packet with an oversized IHL causes an out-of-bounds > read.
Fixed in v6. > > - CKSUM_NONE packets are accepted without rebuilding their checksum, > so forwarding leaves it invalid. Fixed in v6. > > - Pre-existing: the EM path still calls send_single_packet() > after validation frees the packet and returns BAD_PORT, > causing an out-of-bounds array access. That bug is not directly related to the RFC 1812 check bugs fixed in this series. I'm not extending this series to fix more bugs like that one.
