untrusted comment: verify with openbsd-63-base.pub
RWRxzbLwAd76ZZ8sTE2Mz/YlvqiFW8NMR4ZhbYt1eKtwBPnKBbftDraUnQ1bKn8Vt1rU877l44wLY5oEqZABpD3gnu6sIMwHaws=

OpenBSD 6.3 errata 027, December 22, 2018:

The setsockopt(2) system call could overflow mbuf cluster kernel
memory by 4 bytes.

Apply by doing:
   signify -Vep /etc/signify/openbsd-63-base.pub -x 027_pcbopts.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/netinet/ip_output.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_output.c,v
retrieving revision 1.346
diff -u -p -r1.346 ip_output.c
--- sys/netinet/ip_output.c     21 Mar 2018 14:42:41 -0000      1.346
+++ sys/netinet/ip_output.c     20 Dec 2018 12:23:48 -0000
@@ -1249,7 +1249,7 @@ ip_pcbopts(struct mbuf **pcbopt, struct
        * actual options; move other options back
        * and clear it when none present.
        */
-       if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
+       if (m_trailingspace(m) < sizeof(struct in_addr))
               return (EINVAL);
       cnt = m->m_len;
       m->m_len += sizeof(struct in_addr);