This change makes sure that the header of `next` is within max,
returning null if not. This is similar to how `glibc` does it.

No checks were previously being done to assert that `next as usize +
size_of::<cmsghdr>() < max`. Wrapping offset calculations could then
lead to buffer over-reads in the following `(*next).cmsg_len`.

[glibc ref](https://github.com/bminor/glibc/blob/b71d59074b98ad4abd23c136ec9ad4c26e29ee6d/sysdeps/unix/sysv/linux/cmsg_nxthdr.c#L49-L51)

(backport <rust-lang#4903>)
(cherry picked from commit cdc2077)

Likely written to make assertions in the unsound CMSG_NXTHDR implementations
introduced in rust-lang#1235. CMSG_NXTHDR(mhdr, current_cmsghdr) should not be concerned
with the value next_cmsghdr.cmsg_len, which the previous implementation did.

(backport <rust-lang#4903>)
(cherry picked from commit 1e43edb)

Setting `(*pcmsghdr).cmsg_len = cmsg_len as _;` when cmsg_len ranges
from 0 to 64 is invalid as it must always be `>= size_of::<cmsghdr>()`,
rounded up to the nearest alignment boundary.

Some implementations (notably glbic) do check that `cmsg_len >=
size_of::<cmsghdr>()` in `CMSG_NXTHDR`, returning null if so. But
this is more so an extra precaution that is not mentioned in the POSIX
1003.1-2024. It can therefore not be relied on for tests executed on
multiple platforms.

The change also removes the ignoring of some testvalues when targeting AIX.

(backport <rust-lang#4903>)
(cherry picked from commit f391df3)

(backport <rust-lang#4903>)
(cherry picked from commit 99280f2)

(backport <rust-lang#4903>)
(cherry picked from commit 2782869)

(backport <rust-lang#4903>)
(cherry picked from commit befc34b)

…es in CMSG_NXTHDR

musl and its descendants check `next_addr >= max_addr` whilst the rest
do `next_addr > max_addr`. This was previously not reflected in the
implementations, coming to light only after testing was extended to
execute at the controllen boundary.

[musl_ref]: https://www.openwall.com/lists/musl/2025/12/27/1

(backport <rust-lang#4903>)
(cherry picked from commit 17adf2d)

This change makes sure that the header of `next` is within max,
returning null if not. This is similar to how `glibc` does it.

No checks were previously being done to assert that `next as usize +
size_of::<cmsghdr>() < max`. Wrapping offset calculations could then
lead to buffer over-reads in the following `(*next).cmsg_len`.

[glibc ref](https://github.com/bminor/glibc/blob/b71d59074b98ad4abd23c136ec9ad4c26e29ee6d/sysdeps/unix/sysv/linux/cmsg_nxthdr.c#L49-L51)

(backport <#4903>)
(cherry picked from commit cdc2077)

Likely written to make assertions in the unsound CMSG_NXTHDR implementations
introduced in #1235. CMSG_NXTHDR(mhdr, current_cmsghdr) should not be concerned
with the value next_cmsghdr.cmsg_len, which the previous implementation did.

(backport <#4903>)
(cherry picked from commit 1e43edb)

Setting `(*pcmsghdr).cmsg_len = cmsg_len as _;` when cmsg_len ranges
from 0 to 64 is invalid as it must always be `>= size_of::<cmsghdr>()`,
rounded up to the nearest alignment boundary.

Some implementations (notably glbic) do check that `cmsg_len >=
size_of::<cmsghdr>()` in `CMSG_NXTHDR`, returning null if so. But
this is more so an extra precaution that is not mentioned in the POSIX
1003.1-2024. It can therefore not be relied on for tests executed on
multiple platforms.

The change also removes the ignoring of some testvalues when targeting AIX.

(backport <#4903>)
(cherry picked from commit f391df3)

(backport <#4903>)
(cherry picked from commit 99280f2)

(backport <#4903>)
(cherry picked from commit 2782869)

(backport <#4903>)
(cherry picked from commit befc34b)

…es in CMSG_NXTHDR

musl and its descendants check `next_addr >= max_addr` whilst the rest
do `next_addr > max_addr`. This was previously not reflected in the
implementations, coming to light only after testing was extended to
execute at the controllen boundary.

[musl_ref]: https://www.openwall.com/lists/musl/2025/12/27/1

(backport <#4903>)
(cherry picked from commit 17adf2d)