untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWWuAQQ+CJdt1Bpsk4Q3GZfBuzJTcJlSjgF36jSwcLj2jl1Iz14KA57yTsNRFeuA6GTRITtNLqfqlzlZaMZBiiwI=

OpenBSD 7.8 errata 044, August 11, 2026:

Heap or stack corruption in npppd(8) LCP option handling could lead
to crashes.

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 044_npppd.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install npppd:
    cd /usr/src/usr.sbin/npppd
    make obj
    make
    make install

Index: usr.sbin/npppd/npppd/lcp.c
===================================================================
RCS file: /cvs/src/usr.sbin/npppd/npppd/lcp.c,v
diff -u -p -r1.18 lcp.c
--- usr.sbin/npppd/npppd/lcp.c	27 Feb 2019 04:52:19 -0000	1.18
+++ usr.sbin/npppd/npppd/lcp.c	6 Aug 2026 18:53:50 -0000
@@ -471,10 +471,8 @@ lcp_reqci(fsm *f, u_char *inp, int *lenp
 				if (lrej > 0) {
 				/* if there is a reject, will send Rej, not send Nak. */
 				} else {
-					inp -= 2;
-					memcpy(nakbuf, inp, len);
-					nakbuf += len;
-					inp += 2;
+					PUTCHAR(type, nakbuf);
+					PUTCHAR(len, nakbuf);
 					PUTSHORT(f->ppp->mru, nakbuf);
 
 					rcode = CONFNAK;