Re: [PATCH net v4] ipv6: fix dead half of the MTU guard in __ip6_append_data()

[bo cao]

Apologies -- this information was already provided in the v3 thread,
and it was my oversight not to carry it into the v4 commit message as
the bot had asked.  It will be included in the commit message of any
future revision.

As replied on the v3 thread:

The issue was found during an LLM-assisted source audit of the IPv6
fragmentation path (manual code inspection with an LLM's help, not a
production hit or a syzbot report).

It was then verified at runtime with a standalone reproducer: a
single sendmsg() on a raw IPv6 socket with a 1240-byte HOPOPTS cmsg
and IPV6_MTU set to fragheaderlen + 1 triggers the skb_over_panic()
described in the commit message (tested on 6.x, MSG_MORE on a device
without NETIF_F_SG).  The xfrm transport-mode variant from the v2
discussion was identified the same way, by inspection of the
ip6_append_data_mtu() recompute path.

bo cao