untrusted comment: verify with openbsd-79-base.pub
RWTSdNN9A3yvWO8cUV6Y/EmVbt/tvJYRrPBHlp6GOG9Lx1hCYa2W2GUNnzPavHTA9aSDPc3ivpAhmazku2W3+7we58K4BX5s9g4=

OpenBSD 7.9 errata 052, November 14, 2026:

A race in TCP syn cache could crash the kernel remotely.

Apply by doing:
    signify -Vep /etc/signify/openbsd-79-base.pub -x 052_tcpsyn.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/netinet/tcp_input.c
===================================================================
RCS file: /cvs/src/sys/netinet/tcp_input.c,v
diff -u -p -r1.467 tcp_input.c
--- sys/netinet/tcp_input.c	18 Apr 2026 11:16:29 -0000	1.467
+++ sys/netinet/tcp_input.c	8 Nov 2026 13:05:45 -0000
@@ -3360,6 +3360,11 @@ syn_cache_timer(void *arg)
 	uint64_t now;
 	int lastref, do_ecn = 0;
 
+	/*
+	 * Routes in rt_timer are only protected by exclusive netlock.  Grab
+	 * shared netlock here to avoid that syn_cache_put() frees a route.
+	 */
+	NET_LOCK_SHARED();
 	mtx_enter(&syn_cache_mtx);
 	inp = in_pcbref(sc->sc_inplisten);
 	if (inp == NULL)
@@ -3388,7 +3393,6 @@ syn_cache_timer(void *arg)
 		refcnt_take(&sc->sc_refcnt);
 	mtx_leave(&syn_cache_mtx);
 
-	NET_LOCK_SHARED();
 	so = in_pcbsolock(inp);
 	if (so != NULL) {
 		now = tcp_now();
@@ -3399,10 +3403,10 @@ syn_cache_timer(void *arg)
 		tcpstat_inc(tcps_sc_retransmitted);
 	}
 	in_pcbsounlock(inp, so);
-	NET_UNLOCK_SHARED();
 
 	in_pcbunref(inp);
 	syn_cache_put(sc);
+	NET_UNLOCK_SHARED();
 	return;
 
  dropit:
@@ -3416,6 +3420,7 @@ syn_cache_timer(void *arg)
  freeit:
 	mtx_leave(&syn_cache_mtx);
 	syn_cache_put(sc);
+	NET_UNLOCK_SHARED();
 }
 
 /*