Commit 85f5e8d1e3 for frr

commit 85f5e8d1e34a6cbdb27b93a688b77667a89aa43b
Author: Justin Iurman <justin.iurman@6wind.com>
Date:   Fri Nov 6 18:02:05 2026 +0100

    bgpd, zebra: fix the VNI encoding of ZEBRA_ADVERTISE_SUBNET

    bgpd encodes the VNI of ZEBRA_ADVERTISE_SUBNET on 3 bytes, in network
    byte order, with stream_put3(). zebra decoded it with stream_get3()
    until commit 7fb29f49abb3 ("zebra: fix assert crash on corrupt vxlan
    msg"), which replaced it with STREAM_GET(): since then, zebra copies
    these 3 bytes as is into the first 3 bytes of a 4-byte vni_t. zebra
    therefore gets a wrong VNI whatever the host byte order (e.g., VNI
    1000, i.e., 00 03 e8, is read as 0xe80300 on little-endian hosts and
    as 0x03e800 on big-endian hosts), does not find the EVPN instance, and
    advertise-subnet has no effect.

    Encode the VNI on 4 bytes with stream_putl() and decode it with
    STREAM_GETL(), as for the other EVPN messages. Commit cc6d54769b95
    ("bgpd/zebra: use stream_putl/getl to send VNIs") fixed the same issue
    for ZEBRA_ADVERTISE_DEFAULT_GW.

    Fixes: 7fb29f49abb3 ("zebra: fix assert crash on corrupt vxlan msg")
    Signed-off-by: Justin Iurman <justin.iurman@6wind.com>

diff --git a/bgpd/bgp_zebra.c b/bgpd/bgp_zebra.c
index ba792e8a25..5fa3e0f386 100644
--- a/bgpd/bgp_zebra.c
+++ b/bgpd/bgp_zebra.c
@@ -2708,7 +2708,7 @@ int bgp_zebra_advertise_subnet(struct bgp *bgp, int advertise, vni_t vni)

 	zclient_create_header(s, ZEBRA_ADVERTISE_SUBNET, bgp->vrf_id);
 	stream_putc(s, advertise);
-	stream_put3(s, vni);
+	stream_putl(s, vni);
 	stream_putw_at(s, 0, stream_get_endp(s));

 	return zclient_send_message(bgp_zclient);
diff --git a/zebra/zebra_vxlan.c b/zebra/zebra_vxlan.c
index e3504900a1..2d536d883e 100644
--- a/zebra/zebra_vxlan.c
+++ b/zebra/zebra_vxlan.c
@@ -6089,7 +6089,7 @@ void zebra_vxlan_advertise_subnet(ZAPI_HANDLER_ARGS)

 	s = msg;
 	STREAM_GETC(s, advertise);
-	STREAM_GET(&vni, s, 3);
+	STREAM_GETL(s, vni);

 	zevpn = zebra_evpn_lookup(vni);
 	if (!zevpn)