Theo de Raadt <deraadt@openbsd.org> wrote:

> Should our kernel play a different kind of game here?

Correction, lets return the intended errno.  Anyways the purpose here
is to not permit the deep dive into the kernel.

pledge_sockopt() cannot translate one optname to another optname,
that's not what I'm suggesting.

Index: /sys/kern/kern_pledge.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_pledge.c,v
diff -u -p -u -r1.365 kern_pledge.c
--- /sys/kern/kern_pledge.c	4 Sep 2026 02:38:28 -0000	1.365
+++ /sys/kern/kern_pledge.c	8 Sep 2026 22:53:36 -0000
@@ -1447,6 +1460,8 @@ pledge_sockopt(struct proc *p, int set, 
 			switch (optname) {
 			case IP_TOS:
 				return (0);
+			case IPV6_TCLASS:
+				return (ENOPROTOOPT);
 			}
 		}
 		break;
@@ -1455,6 +1470,8 @@ pledge_sockopt(struct proc *p, int set, 
 			switch (optname) {
 			case IPV6_TCLASS:
 				return (0);
+			case IPV6_TCLASS:
+				return (ENOPROTOOPT);
 			}
 		}
 		break;