untrusted comment: verify with openbsd-80-base.pub
RWSMSt0erHTctbS3yas9P9Sv5Sn2wVD0MZqVy02vROdsV1faZuAzW91Ltb3MpPQ1B1+4VYJ97cOjIDsRQlerh5eLDoZZsNAFjAg=

OpenBSD 8.0 errata 003, October 20, 2026:

When IPsec is used with AES-GMAC, a kernel heap overflow could be
triggered remotely.  Only amd64 with AES-NI and octeon with crypto
coprocessor are affected.  AES-GCM is not affected.

Apply by doing:
    signify -Vep /etc/signify/openbsd-80-base.pub -x 003_aesgmac.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/arch/amd64/amd64/aesni.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/aesni.c,v
diff -u -p -r1.54 aesni.c
--- sys/arch/amd64/amd64/aesni.c	13 Aug 2026 21:08:17 -0000	1.54
+++ sys/arch/amd64/amd64/aesni.c	16 Oct 2026 09:22:27 -0000
@@ -446,7 +446,7 @@ int
 aesni_encdec(struct cryptop *crp, struct cryptodesc *crd,
     struct cryptodesc *crda, struct aesni_session *ses)
 {
-	int aadlen, err, ivlen, iskip, oskip, rlen;
+	int aadlen, err, ivlen, iskip, oskip, rlen, buflen;
 	uint8_t iv[EALG_MAX_BLOCK_LEN];
 	uint8_t icb[AESCTR_BLOCKSIZE];
 	uint8_t tag[GMAC_DIGEST_LEN];
@@ -455,19 +455,25 @@ aesni_encdec(struct cryptop *crp, struct
 
 	aadlen = rlen = err = iskip = oskip = 0;
 
-	if (crd->crd_len > ses->ses_buflen) {
+	if (crda) {
+		aadlen = crda->crd_len;
+		if (crda->crd_flags & CRD_F_ESN)
+			aadlen += 4;
+	}
+	buflen = MAX(crd->crd_len, aadlen);
+	if (buflen > ses->ses_buflen) {
 		if (buf != NULL) {
 			explicit_bzero(buf, ses->ses_buflen);
 			free(buf, M_DEVBUF, ses->ses_buflen);
 		}
 
 		ses->ses_buflen = 0;
-		rlen = roundup(crd->crd_len, EALG_MAX_BLOCK_LEN);
-		ses->ses_buf = buf = malloc(rlen, M_DEVBUF, M_NOWAIT |
+		buflen = roundup(buflen, EALG_MAX_BLOCK_LEN);
+		ses->ses_buf = buf = malloc(buflen, M_DEVBUF, M_NOWAIT |
 		    M_ZERO);
 		if (buf == NULL)
 			return (ENOMEM);
-		ses->ses_buflen = rlen;
+		ses->ses_buflen = buflen;
 	}
 
 	/* CBC uses 16, CTR/XTS only 8. */
@@ -507,9 +513,7 @@ aesni_encdec(struct cryptop *crp, struct
 
 	if (crda) {
 		/* Supply GMAC with AAD */
-		aadlen = crda->crd_len;
 		if (crda->crd_flags & CRD_F_ESN) {
-			aadlen += 4;
 			/* SPI */
 			if (crp->crp_flags & CRYPTO_F_IMBUF)
 				m_copydata((struct mbuf *)crp->crp_buf,
Index: sys/arch/octeon/dev/octcrypto.c
===================================================================
RCS file: /cvs/src/sys/arch/octeon/dev/octcrypto.c,v
diff -u -p -r1.8 octcrypto.c
--- sys/arch/octeon/dev/octcrypto.c	24 Oct 2021 10:26:22 -0000	1.8
+++ sys/arch/octeon/dev/octcrypto.c	16 Oct 2026 09:22:28 -0000
@@ -685,7 +685,7 @@ octcrypto_authenc_gmac(struct cryptop *c
 	struct octcrypto_cpu *pcpu = &ses->ses_sc->sc_cpu[cpu_number()];
 	size_t aadlen;
 	size_t ivlen = 8;
-	size_t rlen;
+	size_t rlen, buflen;
 	int error = 0;
 	unsigned int iskip = 0;
 	unsigned int oskip = 0;
@@ -694,16 +694,20 @@ octcrypto_authenc_gmac(struct cryptop *c
 	KASSERT(crde != NULL);
 
 	rlen = roundup(crde->crd_len, AESCTR_BLOCKSIZE);
-	if (rlen > pcpu->pcpu_buflen) {
+	aadlen = crda->crd_len;
+	if (crda->crd_flags & CRD_F_ESN)
+		aadlen += 4;
+	buflen = roundup(MAX(crde->crd_len, aadlen), AESCTR_BLOCKSIZE);
+	if (buflen > pcpu->pcpu_buflen) {
 		if (pcpu->pcpu_buf != NULL) {
 			explicit_bzero(pcpu->pcpu_buf, pcpu->pcpu_buflen);
 			free(pcpu->pcpu_buf, M_DEVBUF, pcpu->pcpu_buflen);
 		}
 		pcpu->pcpu_buflen = 0;
-		pcpu->pcpu_buf = malloc(rlen, M_DEVBUF, M_NOWAIT | M_ZERO);
+		pcpu->pcpu_buf = malloc(buflen, M_DEVBUF, M_NOWAIT | M_ZERO);
 		if (pcpu->pcpu_buf == NULL)
 			return ENOMEM;
-		pcpu->pcpu_buflen = rlen;
+		pcpu->pcpu_buflen = buflen;
 	}
 	buf = pcpu->pcpu_buf;
 
@@ -746,9 +750,7 @@ octcrypto_authenc_gmac(struct cryptop *c
 	((uint8_t *)icb)[AESCTR_BLOCKSIZE - 1] = 1;
 
 	/* Prepare the AAD. */
-	aadlen = crda->crd_len;
 	if (crda->crd_flags & CRD_F_ESN) {
-		aadlen += 4;
 		if (crp->crp_flags & CRYPTO_F_IMBUF)
 			m_copydata((struct mbuf *)crp->crp_buf,
 			    crda->crd_skip, 4, buf);