> [...].  Suppose the kernel copies to ifreq a sockaddr whose sa_len >
> sizeof(struct sockaddr_storage) ?

...which is nto all that implausible; AF_LOCAL sockets can have more or
less unlimited sun_len - well, they should be able to; our
implementation limits them to 255 (because it's stored in char), which
I consider a bug.  But 255 > sizeof(struct sockaddr_storage)....

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B