From: Nick Owens <mischief@offblast.org>
Subject: pf: fix dropped packet byte accounting
To: tech@openbsd.org
Date: Fri, 28 Aug 2026 23:17:22 -0700

tot_len is initialized to zero, so packets dropped early did not
increment dropped byte counters. fixes dropped byte accounting for a
number of early drop paths, including corrupt ip options which is what i
ran into and tested.

later assignments still override this and work as before.

diff --git a/sys/net/pf.c b/sys/net/pf.c
index 130843a03a1..53c586a0acd 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -8040,6 +8040,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
 	pd->dir = dir;
 	pd->kif = kif;		/* kif is NULL when called by pflog */
 	pd->m = m;
+	pd->tot_len = pd->m->m_pkthdr.len;
 	pd->sidx = (dir == PF_IN) ? 0 : 1;
 	pd->didx = (dir == PF_IN) ? 1 : 0;
 	pd->af = pd->naf = af;