There existed a race when a process was trying to read from a spliced socket.  soreceive() releases splsoftnet for uiomove().  In that moment, somove() could pull the mbuf from the receive buffer.  After that, soreceive removed the mbuf again.  The corrupted length accounting resulted in a panic. The fix is to block read calls in soreceive() until splicing has been finished. just commit deraadt@
There existed a race when a process was trying to read from a spliced
socket.  soreceive() releases splsoftnet for uiomove().  In that
moment, somove() could pull the mbuf from the receive buffer.  After
that, soreceive removed the mbuf again.  The corrupted length
accounting resulted in a panic.
The fix is to block read calls in soreceive() until splicing has
been finished.
just commit deraadt@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars