1From df97e1c57780588639d8f6aff7dd8f1db8b63c19 Mon Sep 17 00:00:00 2001
 2From: Liam Wachter <liam@asymmetric.re>
 3Date: Fri, 20 Mar 2026 12:19:40 -0400
 4Subject: [PATCH] dns: fix nameserver OOB read in IPv6-disabled fallback
 5
 6In __res_msend_rc(), the IPv6-disabled fallback check uses conf->ns[nns]
 7inside a loop controlled by i, so it tests a fixed slot instead of
 8walking configured nameservers. This reads one past the array's size.
 9
10Use conf->ns[i] so the loop correctly detects whether all configured
11nameservers are IPv6-only.
12---
13 src/network/res_msend.c | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/src/network/res_msend.c b/src/network/res_msend.c
17index fcb52513..51d42ecb 100644
18--- a/src/network/res_msend.c
19+++ b/src/network/res_msend.c
20@@ -124,7 +124,7 @@ int __res_msend_rc(int nqueries, const unsigned char *const *queries,
21 
22 	/* Handle case where system lacks IPv6 support */
23 	if (fd < 0 && family == AF_INET6 && errno == EAFNOSUPPORT) {
24-		for (i=0; i<nns && conf->ns[nns].family == AF_INET6; i++);
25+		for (i=0; i<nns && conf->ns[i].family == AF_INET6; i++);
26 		if (i==nns) {
27 			pthread_setcancelstate(cs, 0);
28 			return -1;
29-- 
302.49.0
31