GHSA-8v32-9xf8-r765: Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

netifipv6calcreachabletime() in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6->basereachabletime as minreachable + sysrand32get() % (maxreachable - minreachable), where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both minreachable and the modulus collapse so the function returns 0, and netifipv6setreachabletime() stores that 0 into ipv6->reachabletime.

The basereachabletime is attacker-controlled: handlerainput() in subsys/net/ip/ipv6nbr.c accepts the Reachable Time field of an incoming Router Advertisement whenever it is nonzero and <= MAXREACHABLETIME, so a single unauthenticated, link-local RA carrying a Reachable Time of 1 drives the computed reachable time to 0. Router Advertisements are unauthenticated by default and require only adjacency to the target link.

When a neighbor is subsequently confirmed reachable, netipv6nbrsetreachabletimer() reads the value and executes NETASSERT(time, "Zero reachable timeout!"). On builds with CONFIGASSERT enabled this triggers a fatal kernel assertion — a remote denial of service; on builds without assertions the reachable timer is armed with KMSEC(0) and fires immediately, forcing reachable neighbors into perpetual re-solicitation (STALE), degrading Neighbor Discovery. The impact is limited to availability; there is no memory-safety, confidentiality, or integrity consequence.