diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -287,6 +287,8 @@
 #endif
 		int mtu;
 
+		/* icmp_nextmtu is attacker-controlled; existing <296 clamp locks the
+		 * route, otherwise the PMTU is only ever reduced (RTF_HOST, !RTV_MTU). */
 		mtu = ntohs(icp->icmp_nextmtu);
 		if (!mtu)
 			mtu = ip_next_mtu(rt->rt_rmx.rmx_mtu, 1);