Commit f7bb65d30a for frr

commit f7bb65d30aa3fd6c004a899f068021d1219342e5
Author: Amr Shadid <amr.shadid.2016@gmail.com>
Date:   Tue Sep 15 06:46:42 2026 +0300

    isisd: consume trailing bytes in extended-reach sub-TLVs

    unpack_item_ext_subtlvs() loops while more than a 2-byte sub-TLV header is
    left, so if a sub-TLV area ends with one or two stray bytes the loop exits
    without consuming them.  The caller then reads the next Extended Reachability
    item from the wrong offset - showing a neighbor that was never sent - before
    the LSP is finally rejected as malformed.

    Skip any declared but unparsed bytes before returning so the stream stays on
    the item boundary.

    Regenerate the two isisd TLV fuzz corpus entries whose extended-reach parsing
    this changes; they now parse to the boundary instead of misreading the next
    item.

    Fixes: #22820
    Signed-off-by: Amr Shadid <amr.shadid.2016@gmail.com>

diff --git a/isisd/isis_tlvs.c b/isisd/isis_tlvs.c
index 822a3e68bd..bc62035cbe 100644
--- a/isisd/isis_tlvs.c
+++ b/isisd/isis_tlvs.c
@@ -1986,6 +1986,10 @@ static int unpack_item_ext_subtlvs(uint16_t mtid, uint8_t len, struct stream *s,
 		sum += subtlv_len + ISIS_SUBTLV_HDR_SIZE;
 	}

+	/* Skip trailing bytes too small for a sub-TLV, to stay aligned */
+	if (sum < len)
+		stream_forward_getp(s, len - sum);
+
 	return 0;
 }

diff --git a/tests/isisd/test_fuzz_isis_tlv_tests.h.gz b/tests/isisd/test_fuzz_isis_tlv_tests.h.gz
index 195f668e33..702bf1cfd5 100644
Binary files a/tests/isisd/test_fuzz_isis_tlv_tests.h.gz and b/tests/isisd/test_fuzz_isis_tlv_tests.h.gz differ