GeezerVison

Summary

Parse ancillary-message bytes without assuming the public input slice is aligned for cmsghdr. Read complete headers with unaligned loads and validate data-prefix, declared-length, available-byte and next-offset bounds before slicing or advancing. A truncated final payload is returned only up to the bytes available; malformed short headers terminate parsing rather than underflowing.

Preserve the relevant platform-specific next-header rules, including Solaris/illumos rounding, Linux musl/ohos and emscripten strict end boundaries, and Hurd's next-message fit check. For an unaligned slice, offsets are interpreted relative to the beginning of the supplied bytes. Traversal continues to use the existing i32-sized checked_cmsg_space bound.

This does not change the generic ancillary packer, whose alignment and ownership require separate work, and does not claim complete Python recvmsg diagnostics or arbitrary-platform runtime parity. #9638 separately addresses the AF_ALG send helper.

Validation

• Independently source-reviewed libc 0.2.189 platform CMSG layouts and boundary rules, unaligned accesses, checked arithmetic, lifetimes, malformed inputs and test safety.
• Added host-internal tests for unaligned headers, short/truncated and maximal declared lengths, zero-payload boundaries, and comparison against the platform CMSG_NXTHDR macro. These validate byte-buffer invariants, not Python API behavior.
• rustfmt, git diff --check, and normal repository hooks passed. Source merge-tree with Safeguard AF_ALG control and send buffers #9638 was clean.
• No local RustPython build or execution, no host-unit-test execution, and no cross-target runtime validation were performed. Hosted CI must validate compilation and tests; unsupported targets still need their own execution evidence.