{"record":{"id":"679d2382240438eb","repo":"slackhq/nebula","slug":"csum-offsets-out-of-range-start-d-offset-d-len","errorCode":null,"errorMessage":"csum offsets out of range: start=%d offset=%d len=%d","messagePattern":"csum offsets out of range: start=(.+?) offset=(.+?) len=(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"overlay/tio/virtio/segment_linux.go","lineNumber":419,"sourceCode":"\t\t}\n\t\tbinary.BigEndian.PutUint16(seg[csumStart+udpChecksumOff:csumStart+udpChecksumOff+2], csum)\n\n\t\tif err := yield(seg); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// FinishChecksum computes the L4 checksum for a non-GSO packet that the kernel handed us with NEEDS_CSUM set.\n// CsumStart / CsumOffset point at the 16-bit checksum field.\n// We zero it, fold a full sum from the partial one that the kernel provided, and store the result.\nfunc FinishChecksum(seg []byte, hdr Hdr) error {\n\tcs := int(hdr.CsumStart)\n\tco := int(hdr.CsumOffset)\n\tif cs+co+2 > len(seg) {\n\t\treturn fmt.Errorf(\"csum offsets out of range: start=%d offset=%d len=%d\", cs, co, len(seg))\n\t}\n\t// The kernel stores a partial pseudo-header sum at [cs+co:]; sum over the\n\t// L4 region starting at cs, folding the prior partial in as the seed.\n\tpartial := binary.BigEndian.Uint16(seg[cs+co : cs+co+2])\n\tseg[cs+co] = 0\n\tseg[cs+co+1] = 0\n\tcsum := ^checksum.Checksum(seg[cs:], partial)\n\t// RFC 768: UDP transmits a computed zero as all ones, since all-zero is the reserved \"no checksum\" value.\n\tif co == udpChecksumOff && csum == 0 {\n\t\tcsum = 0xffff\n\t}\n\tbinary.BigEndian.PutUint16(seg[cs+co:cs+co+2], csum)\n\treturn nil\n}\n\n// foldComplement folds a 32-bit one's-complement partial sum to 16 bits and\n// complements it, yielding the on-wire Internet checksum value.\nfunc foldComplement(sum uint32) uint16 {","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/overlay/tio/virtio/segment_linux.go#L401-L437","documentation":"Range check in FinishChecksum: CsumStart+CsumOffset+2 exceeds the packet length, so the 16-bit checksum field the kernel asked us to finalize lies outside the buffer. The message reports start, offset, and length; it means the virtio header offsets and the actual segment size disagree.","triggerScenarios":"Thrown at overlay/tio/virtio/segment_linux.go:419 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Drop the malformed segment","Check vnet header size negotiation (VIRTIO_NET_HDR size vs TUNSETOFFLOAD)","Log hdr and seg length to find which peer/kernel produces the bad offsets"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}