From: Zack Newman <zack@philomathiclife.com>
Subject: Re: Should the default MTU of wg(4) be 1408?
To: tech@openbsd.org
Date: Sun, 13 Sep 2026 16:31:48 -0600

I've confirmed that there is a bug in OpenBSD, and I'm quite confident
it's partially or entirely related to commit c061998. Why? When I install
OpenBSD 7.6 (i.e., the most recent release _before_ that commit) on my
VPS, I don't experience premature fragmentation. Similarly, when I
install a Linux-based OS-which is the closest thing to a "reference"
implementation of WireGuard seeing how Jason Donenfeld is the maintainer
of it-I don't experience premature fragmentation. In contrast when I
install OpenBSD 7.7 (i.e., the oldest release _after_ that commit), I
experience the same fragmentation that I do on OpenBSD 7.9-stable.

What's interesting (and more complex) about this bug is that it appears
to be dependent on _all_ of the following criteria:

* OpenBSD 7.7 or newer.
* vio(4) to be used for the "physical" connection.
* IPv6 used to establish the WireGuard tunnel.
* wg(4) MTU that is _not_ a multiple of 16.
* wg(4) MTU that is larger than the MTU of vio(4) less 96 (and of course
   not bigger than the MTU of vio(4) less 80).

The WireGuard protocol expressly requires that padding of the plaintext
not exceed the MTU, so this violates the protocol.

I'll submit a more proper bug report to @bugs shortly, but I thought I'd
conclude this thread.