FreeBSD's userland PPP daemon overflowed on a crafted peer option

FreeBSD-SA-26:60.ppp announced 2026-08-25. Three CVEs: CVE-2026-58095 format overflow, CVE-2026-58096 undersized out-of-bounds write, CVE-2026-58097 set-command overflow. ppp(8) is setuid root and needs the network group. A peer can crash it or potentially execute as root. A local user with the command interface can do the same on 58097. Do not invent a fourth CVE.

10dd09ca4c77 (markjdb, 2026-07-31). Reject endpoint discriminator options shorter than three bytes. An undersized option was a large out-of-bounds write. RFC 1717 section 5.1.3. PR 271910. Reported by Robert Morris and Décio Brandão. Reviewed by emaste.

281fb7d8a20b (markjdb, 2026-08-03). Count two output characters per address byte when formatting that option. A too-large option overflowed the print buffer. Reported by Joshua Rogers.

Signed correction hashes: releng/15.1 5c00c1e02276 (set-command), also 428f4b194cef and 23deefa40b8d. releng/15.0 4ad6d3b4ccb3. releng/14.4 8544e4ce677f. Credits also list Reo Shiseki. Tags 15.1-p3 / 15.0-p13 / 14.4-p9 are this batch, not a separate release story.