# DF-0338 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: tcp_get_inpnotify passes the raw ICMP nextmtu to tcp_mtudisc; mtu<sizeof(tcpiphdr)(40) -> maxopd=mtu-40 negative, the early-out does not bail, and t_maxseg is stored negative. On-path attacker: forged ICMP frag-needed with tiny mtu. tcp_minmss exists but is never consulted.

## Impact ceiling
none

## Cited refs
- sys/netinet/tcp_subr.c:1448
- sys/netinet/tcp_subr.c:1784

## Fix
Clamp mtu to >= sizeof(struct tcpiphdr) before computing maxopd.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.