CVE-2026-12632

Zephyr's Precision Time Protocol receive handler ptpmsgpostrecv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptpmsgtype() (msg->header.typemajorsdoid & 0xF, range 0-15) and uses it to index the msgsize[] table. That table only defines entries up to PTPMSGMANAGEMENT (0xD), giving it ARRAYSIZE == 14. Before the fix there was no upper-bound check, so the undefined types 0xE and 0xF indexed one or two int slots past the end of the array — an out-of-bounds read of adjacent read-only data.

The out-of-bounds value is then reused as a length: it gates msgsize[type] > cnt, and when it is small or negative it makes cnt - msgsize[type] a large positive budget passed to msgtlvpost_recv(), whose TLV loop then walks the message suffix past the received bytes, performing further out-of-bounds reads and in-place byte-swap writes on memory beyond the message slab.

The defect is reached directly from the network: ptpporteventgen() in subsys/net/lib/ptp/port.c reads a PTP frame with ptptransportrecv() and calls ptpmsgpostrecv() with the attacker-chosen type. PTP uses UDP multicast or raw Ethernet (0x88F7) and is unauthenticated, so any host on the same link can trigger the indexing on a CONFIG_PTP-enabled node with no preconditions.

The reliably reproducible impact is a denial of service (fault/crash); a limited memory-corruption path exists but depends on the build-specific value adjacent to msgsize[], which the attacker cannot tune. The fix rejects type >= ARRAYSIZE(msg_size) with -EBADMSG before any indexing.