GeezerVison

Summary

Build AF_ALG sendmsg control messages in storage aligned for cmsghdr, with all exposed bytes initialized. Compute message lengths, padding, total size and rounded allocation size with checked arithmetic before writing, so oversized IVs cannot be truncated to a smaller CMSG length followed by a copy using the original size. Allocate the control buffer once and report allocation/size errors rather than relying on unchecked growth. Validate the IV descriptor length before copying, and use the existing unlocked snapshot strategy for payloads across blocking sends.

This change is scoped to the AF_ALG host helper. Generic ancillary packing/parsing, argument conversion, iovec behavior and the existing difference from CPython's padded IV cmsg_len remain unchanged. Size/allocation errors are I/O errors here, not a claim of exact CPython exception parity. The wrapper validates the IV length before its existing copy; valid but very large IVs can still require a large allocation. Mutable and non-bytes payloads are copied once, which changes concurrent mutation visibility and adds allocation/MemoryError cost; immutable bytes keep the existing borrowed fast path. Existing argument validation, IV handling, binder behavior, and the shared snapshot helper's error path are not claimed fully CPython-compatible.

Validation

• Independently source-reviewed Linux CMSG layout, alignment, initialization, checked size arithmetic including 32-bit rounded allocation, ownership and lifetime through the syscall.
• rustfmt, git diff --check and normal repository hooks passed.
• No local RustPython build, runtime test, benchmark, or dedicated oversized-IV test was run. Hosted CI is required. Existing test_socket.LinuxKernelCryptoAPI AES tests exercise this path only when AF_ALG accept and the relevant kernel algorithms work; their existing expected-failure markers are unchanged. The separate accept change is Fix accepting Linux AF_ALG sockets #9637, and neither PR requires a stacked base.