untrusted comment: verify with openbsd-79-base.pub
RWTSdNN9A3yvWOirEzCgovfa/4Sjrxu7I5cigiWhwWzWU7yfBDpcVhYADK+noDkUD8wWPyj2krL2AJUVlXSdz++iYj/qnseWCwc=

OpenBSD 7.9 errata 036, October 20, 2026:

By providing malformed config mode payloads, a malicious IKEv1 peer
could crash isakmpd(8) due to an out-of-bounds read.

Apply by doing:
    signify -Vep /etc/signify/openbsd-79-base.pub -x 036_isakmpd.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install isakmpd:
    cd /usr/src/sbin/isakmpd
    make obj
    make
    make install

Index: sbin/isakmpd/isakmp_cfg.c
===================================================================
RCS file: /cvs/src/sbin/isakmpd/isakmp_cfg.c,v
diff -u -p -u -r1.41 isakmp_cfg.c
--- sbin/isakmpd/isakmp_cfg.c	15 Jan 2018 09:54:48 -0000	1.41
+++ sbin/isakmpd/isakmp_cfg.c	6 Oct 2026 10:01:47 -0000
@@ -635,8 +635,8 @@ cfg_verify_hash(struct message *msg)
 	struct payload *hashp = payload_first(msg, ISAKMP_PAYLOAD_HASH);
 	struct ipsec_sa *isa = msg->isakmp_sa->data;
 	struct prf     *prf;
-	u_int8_t       *hash, *comp_hash;
-	size_t          hash_len;
+	u_int8_t       *hash, *comp_hash, *rest, *end;
+	size_t          hash_len, rest_len;
 
 	if (!hashp) {
 		log_print("cfg_verify_hash: phase 2 message missing HASH");
@@ -646,6 +646,16 @@ cfg_verify_hash(struct message *msg)
 	}
 	hash = hashp->p;
 	hash_len = GET_ISAKMP_GEN_LENGTH(hash);
+
+	end = (u_int8_t *)msg->iov[0].iov_base + msg->iov[0].iov_len;
+	rest = hash + hash_len;
+	if (hash_len < ISAKMP_GEN_SZ || rest < hash || rest > end) {
+		message_drop(msg, ISAKMP_NOTIFY_INVALID_HASH_INFORMATION,
+		    0, 1, 0);
+		return -1;
+	}
+	rest_len = end - rest;
+
 	comp_hash = malloc(hash_len - ISAKMP_GEN_SZ);
 	if (!comp_hash) {
 		log_error("cfg_verify_hash: malloc (%lu) failed",
@@ -662,8 +672,7 @@ cfg_verify_hash(struct message *msg)
 	prf->Init(prf->prfctx);
 	prf->Update(prf->prfctx, msg->exchange->message_id,
 	    ISAKMP_HDR_MESSAGE_ID_LEN);
-	prf->Update(prf->prfctx, hash + hash_len,
-	    msg->iov[0].iov_len - ISAKMP_HDR_SZ - hash_len);
+	prf->Update(prf->prfctx, rest, rest_len);
 	prf->Final(comp_hash, prf->prfctx);
 	prf_free(prf);