{"record":{"id":"081b6f5bbb551b44","repo":"cilium/cilium","slug":"unexpected-success-w","errorCode":null,"errorMessage":"unexpected success: %w","messagePattern":"unexpected success: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/probes/probes.go","lineNumber":321,"sourceCode":"\t\tl, err := link.AttachNetkit(link.NetkitOptions{\n\t\t\tProgram:   prog,\n\t\t\tAttach:    ebpf.AttachNetkitPrimary,\n\t\t\tInterface: math.MaxInt,\n\t\t})\n\t\t// We rely on this being checked during the syscall. With\n\t\t// an otherwise correct payload we expect ENODEV here as\n\t\t// an indication that the feature is present.\n\t\tif errors.Is(err, unix.ENODEV) {\n\t\t\treturn nil\n\t\t}\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating link: %w\", err)\n\t\t}\n\t\tif err := l.Close(); err != nil {\n\t\t\treturn fmt.Errorf(\"closing link: %w\", err)\n\t\t}\n\n\t\treturn fmt.Errorf(\"unexpected success: %w\", err)\n\t})\n})\n\n// HaveNetkitScrub returns nil if the running kernel supports netkit scrub\n// attribute.\nvar HaveNetkitScrub = sync.OnceValue(func() error {\n\tns, err := netns.New()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create netns: %w\", err)\n\t}\n\tdefer ns.Close()\n\n\treturn ns.Do(func() error {\n\t\thostIfName := \"tmpnkscr0\"\n\t\tpeerIfName := \"tmpnkscr1\"\n\n\t\tvar hostMac, peerMac mac.MAC\n\t\tnetkit := &netlink.Netkit{","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/probes/probes.go#L303-L339","documentation":"The HaveNetkit probe considers ENODEV the success signal for netkit support. If link.AttachNetkit unexpectedly succeeded (nil error) even though the probe passed an out-of-range interface index (math.MaxInt), the probe returns 'unexpected success'. This is an internal invariant violation — the kernel accepted a netkit attach it should have rejected — and it leaves the feature probe in an undefined state.","triggerScenarios":"HaveNetkit() on a kernel where attaching a netkit link with Interface=math.MaxInt does not return ENODEV but succeeds, i.e. the syscall semantics differ from what the probe expects (unusual/patched kernels orcilium/vishnetlink behavior changes).","commonSituations":"Running on kernels with backported/modified netkit semantics; vendor kernels deviating from mainline; testing against a kernel where interface index validation is not performed on the ENODEV path.","solutions":["Report/inspect the kernel's netkit attach behavior for out-of-range ifindex values","Pin to a mainline-supported kernel (>= 6.7 stable) so probe semantics hold","Update cilium/cilium and cilium/ebpf libraries so probe expectations match current kernels","Treat the probe error as 'netkit support unknown' and fall back to the default datapath"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := probes.HaveNetkit(); err != nil {\n    if strings.Contains(err.Error(), \"unexpected success\") {\n        log.Warn(\"netkit probe invariant violated; using default datapath\")\n        useDefaultDatapath()\n        return nil\n    }\n    return err\n}","preventionTips":["Use mainline stable kernels where ENODEV semantics hold","Keep cilium/ebpf and cilium versions aligned","Avoid vendor-patched kernels for capability probing","Report deviations to cilium maintainers"],"tags":["ebpf","netkit","linux","kernel-invariant"],"backgroundTag":"netkit-probe-unexpected-success","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}