GeezerVison

Summary

Encode generic ancillary messages with checked per-message offsets and unaligned header-field stores instead of dereferencing cmsghdr pointers into a Vec<u8>. This also handles platforms such as AIX that do not pad between control messages. Keep the existing public Vec<u8> return API, documenting that its byte allocation does not promise CMSG alignment.

Add an aligned owned buffer for the Python sendmsg path. The buffer is 16-byte aligned for supported platform CMSG layouts, zeroes exposed padding, stays alive through syscall retries and does not add a payload copy beyond the existing snapshots. Bound the combined control size to the CPython 3.15 SOCKLEN_T_LIMIT before constructing it and validate rounded allocation size. Reuse the same initialized, aligned owner for recvmsg_into control storage, including checked size and msg_controllen conversion.

The encoder uses explicit checked offsets rather than CMSG_NXTHDR while building messages. Consequently, it can encode layouts that some previous platform macro boundary checks rejected. The existing infallible allocation policy, Python argument/iovec handling and other socket behavior are unchanged. #9640 independently addresses ancillary parsing and #9638 the AF_ALG-specific send helper.

Validation

• Independent source review covered 16-byte alignment requirements, unaligned AIX headers, initialized bytes, bounds and 32-bit allocation rounding, public API, ownership and retries. No additional per-payload copy was found; performance was not benchmarked.
• Added host-internal tests for aligned and unaligned encoding, zero/odd payloads, multiple headers, zero padding, equivalent legacy/aligned bytes, empty buffers and receive-storage alignment/size checks. These test byte-layout invariants rather than Python API behavior.
• rustfmt, git diff --check, and normal repository hooks passed. Source merge-trees were clean against Fix accepting Linux AF_ALG sockets #9637, Safeguard AF_ALG control and send buffers #9638 and Safely parse unaligned ancillary messages #9640.
• No local RustPython build or execution, host-unit-test execution, or cross-target runtime validation. Hosted CI is required; existing test_socket sendmsg coverage is also relevant where the platform supports it.