untrusted comment: verify with openbsd-65-base.pub
RWSZaRmt1LEQT+2X0/cEJXZ8rp1IUFzUv56uGkEjXz2VVmKDpSbGukxs3xbfXoKmz12nJviIbfEWDNttTMecDAYzddDDAZMo4wE=

OpenBSD 6.5 errata 033, March 13, 2020:

Local outbound UDP broadcast or multicast packets sent by a spliced
socket can crash the kernel.

Apply by doing:
   signify -Vep /etc/signify/openbsd-65-base.pub -x 033_sosplice.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/kern/uipc_socket.c
===================================================================
RCS file: /cvs/src/sys/kern/uipc_socket.c,v
retrieving revision 1.231
diff -u -p -r1.231 uipc_socket.c
--- sys/kern/uipc_socket.c      17 Dec 2018 16:46:59 -0000      1.231
+++ sys/kern/uipc_socket.c      11 Mar 2020 23:39:20 -0000
@@ -1390,9 +1390,15 @@ somove(struct socket *so, int wait)
       /*
        * By splicing sockets connected to localhost, userland might create a
        * loop.  Dissolve splicing with error if loop is detected by counter.
+        *
+        * If we deal with looped broadcast/multicast packet we bail out with
+        * no error to suppress splice termination.
        */
-       if ((m->m_flags & M_PKTHDR) && m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) {
-               error = ELOOP;
+       if ((m->m_flags & M_PKTHDR) &&
+           ((m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) ||
+           ((m->m_flags & M_LOOP) && (m->m_flags & (M_BCAST|M_MCAST))))) {
+               if (m->m_pkthdr.ph_loopcnt >= M_MAXLOOP)
+                       error = ELOOP;
               goto release;
       }