## Host environment - Operating system: Debian GNU/Linux 13 (trixie) - OS/kernel version: Linux 6.12.115+deb13.1-amd64 - Architecture: x86_64 - QEMU flavor: qemu-nbd - QEMU version: qemu-nbd 10.0.13 (Debian 1:10.0.13+ds-0+deb13u1), the same code path is present in current master (f29ccc28, 2026-11-03) - QEMU command line: `qemu-nbd -f raw --socket=/tmp/nbd.sock /tmp/disk.raw` ## Emulated/Virtualized environment Not applicable: this is the server side of the NBD protocol. ## Description of problem A client that sends `NBD_OPT_SET_META_CONTEXT` (or `NBD_OPT_LIST_META_CONTEXT`) with a declared option length larger than the payload the handler actually consumes receives a valid reply (the negotiated meta context plus `NBD_REP_ACK`), and the server then aborts on the next option header: qemu-nbd: nbd/server.c:1224: nbd_negotiate_options: Assertion `!client->optlen' failed. The process dies with SIGABRT (exit 134) and the connection is reset. The same happens for every process hosting an NBD export: qemu-nbd, a qemu-storage-daemon instance (all its exports plus QMP go down), or a qemu-system instance with an internal NBD server started via `nbd-server-start`. In the default qemu-nbd configuration the client needs no authentication, only the ability to connect to the socket. ## Steps to reproduce 1. Start an export: truncate -s 1M /tmp/disk.raw qemu-nbd -f raw --socket=/tmp/nbd.sock /tmp/disk.raw & 2. Save as repro.py and run it (takes about a second): python3 repro.py /tmp/nbd.sock ```python #!/usr/bin/env python3 import socket import struct import sys path = sys.argv[1] if len(sys.argv) > 1 else '/tmp/nbd.sock' s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.connect(path) s.settimeout(1.0) def opt(number, payload): return b'IHAVEOPT' + struct.pack('>II', number, len(payload)) + payload stream = b''.join([ struct.pack('>I', 1), # client flags: FIXED_NEWSTYLE opt(8, b''), # NBD_OPT_STRUCTURED_REPLY b'IHAVEOPT' + struct.pack('>II', 10, 28), # NBD_OPT_SET_META_CONTEXT, # declared length 28, but the body below is only 27 bytes: struct.pack('>I', 0) # export name length: 0 + struct.pack('>I', 1) # number of queries: 1 + struct.pack('>I', 15) + b'base:allocation', # query: base:allocation opt(7, struct.pack('>IH', 0, 0)), # NBD_OPT_GO (never processed) ]) s.sendall(stream) try: while s.recv(4096): pass except Exception: pass s.close() ``` 3. Observed: qemu-nbd aborts with the assertion message above, exit code 134. Expected: the server should reply `NBD_REP_ERR_TL_MISMATCH` and keep serving, as it already does for other options with inconsistent lengths. ## Additional information Root cause: `nbd_negotiate_meta_queries()` (nbd/server.c:1028 on master, dispatched at nbd/server.c:1343) reads the export name, the query count and the query strings, sends the negotiated meta contexts and the final `NBD_REP_ACK`, then returns success without checking that it consumed the full declared option length. Back in the option loop of `nbd_negotiate_options()`, the header of the next option is read first and the leftover `client->optlen` then trips `assert(!client->optlen)` (nbd/server.c:1224 on master, same line in 10.0.13). All sibling option handlers validate the leftover payload: the NBD_OPT_INFO and NBD_OPT_GO handler ends with `if (client->optlen) { return nbd_reject_length(client, false, errp); }` (nbd/server.c:650 on master), and the option switch does the same for NBD_OPT_STRUCTURED_REPLY and NBD_OPT_EXTENDED_HEADERS (nbd/server.c:1326 and 1348 on master), while everything else drains the payload via `nbd_opt_drop()`. Only the meta-context options lack the check. A possible fix is to add the same `if (client->optlen)` guard before the final `NBD_REP_ACK` in `nbd_negotiate_meta_queries()`. Affected versions: the check has been missing since the handler was introduced in v2.12.0 (verified against the v2.12.0 tag, which sends the final ACK the same way). Reproduced on stock qemu-nbd 10.0.13, still present in master (f29ccc28, 2026-11-03). Found by coverage-guided fuzzing of the NBD server (AFL++) with FOBOS-NT. The reproducer above is a hand-reduced minimal byte stream and needs no fuzzing tools.