Fix subobject bounds in various places.

sys/dev/virtio/block/virtio_blk.c

@@ -901,7 +901,7 @@
 	req = TAILQ_FIRST(&sc->vtblk_req_free);
 	if (req != NULL) {
 		TAILQ_REMOVE(&sc->vtblk_req_free, req, vbr_link);
-		bzero(&req->vbr_hdr, sizeof(struct vtblk_request) -
+		bzero(__unbounded_addressof(req->vbr_hdr), sizeof(struct vtblk_request) -
 		    offsetof(struct vtblk_request, vbr_hdr));
 	}
 

sys/kern/kern_kthread.c

@@ -292,9 +292,10 @@ kthread_add1(void (*func)(void *), void *arg, struct proc *p,
 	if (newtdp != NULL)
 		*newtdp = newtd;
 
-	bzero(&newtd->td_startzero,
+	bzero(__unbounded_addressof(newtd->td_startzero),
 	    __rangeof(struct thread, td_startzero, td_endzero));
-	bcopy(&oldtd->td_startcopy, &newtd->td_startcopy,
+	bcopy(__unbounded_addressof(oldtd->td_startcopy),
+		__unbounded_addressof(newtd->td_startcopy),
 	    __rangeof(struct thread, td_startcopy, td_endcopy));
 
 	/* set up arg0 for 'ps', et al */

sys/kern/kern_proc.c

@@ -1400,7 +1400,7 @@ void
 pstats_fork(struct pstats *src, struct pstats *dst)
 {
 
-	bzero(&dst->pstat_startzero,
+	bzero(__unbounded_addressof(dst->pstat_startzero),
 	    __rangeof(struct pstats, pstat_startzero, pstat_endzero));
 	bcopy(&src->pstat_startcopy, &dst->pstat_startcopy,
 	    __rangeof(struct pstats, pstat_startcopy, pstat_endcopy));

sys/kern/kern_prot.c

@@ -2729,7 +2729,8 @@ void
 crcopy(struct ucred *dest, struct ucred *src)
 {
 
-	bcopy(&src->cr_startcopy, &dest->cr_startcopy,
+	bcopy(__unbounded_addressof(src->cr_startcopy),
+		__unbounded_addressof(dest->cr_startcopy),
 	    (unsigned)((caddr_t)&src->cr_endcopy -
 		(caddr_t)&src->cr_startcopy));
 	dest->cr_flags = src->cr_flags;

sys/kern/kern_thr.c

@@ -245,9 +245,10 @@ thread_create(struct thread *td, struct rtprio *rtp,
 	if (error)
 		goto fail;
 
-	bzero(&newtd->td_startzero,
+	bzero(__unbounded_addressof(newtd->td_startzero),
 	    __rangeof(struct thread, td_startzero, td_endzero));
-	bcopy(&td->td_startcopy, &newtd->td_startcopy,
+	bcopy(__unbounded_addressof(td->td_startcopy),
+		__unbounded_addressof(newtd->td_startcopy),
 	    __rangeof(struct thread, td_startcopy, td_endcopy));
 	newtd->td_proc = td->td_proc;
 	newtd->td_rb_list = newtd->td_rbp_list = newtd->td_rb_inact = 0;

sys/kern/subr_uio.c

@@ -544,7 +544,8 @@ cloneuio(struct uio *uiop)
 	int iovlen;
 
 	uio = allocuio(uiop->uio_iovcnt);
-	bcopy(&uiop->uio_startcopy, &uio->uio_startcopy,
+	bcopy(__unbounded_addressof(uiop->uio_startcopy),
+		__unbounded_addressof(uio->uio_startcopy),
 	    __rangeof(struct uio, uio_startcopy, uio_endcopy));
 	iovlen = uiop->uio_iovcnt * sizeof(struct iovec);
 	bcopy(uiop->uio_iov, uio->uio_iov, iovlen);

sys/netinet/in_pcb.c

@@ -639,7 +639,7 @@ in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo)
 	inp = uma_zalloc_smr(pcbinfo->ipi_zone, M_NOWAIT);
 	if (inp == NULL)
 		return (ENOBUFS);
-	bzero(&inp->inp_start_zero, inp_zero_size);
+	bzero(__unbounded_addressof(inp->inp_start_zero), inp_zero_size);
 #ifdef NUMA
 	inp->inp_numa_domain = M_NODOM;
 #endif

sys/netinet/tcp_subr.c

@@ -2215,7 +2215,7 @@ tcp_newtcpcb(struct inpcb *inp, struct tcpcb *listening_tcb)
 	 * code that rely on that.  For now take safe approach and zero whole
 	 * tcpcb.  This definitely can be optimized.
 	 */
-	bzero(&tp->t_start_zero, t_zero_size);
+	bzero(__unbounded_addressof(tp->t_start_zero), t_zero_size);
 
 	/* Initialise cc_var struct for this tcpcb. */
 	tp->t_ccv.tp = tp;

sys/netinet/udp_usrreq.c

@@ -1539,7 +1539,7 @@ udp_attach(struct socket *so, int proto, struct thread *td)
 	inp->inp_flowid = atomic_fetchadd_int(&udp_flowid, 1);
 	inp->inp_flowtype = M_HASHTYPE_OPAQUE;
 	up = intoudpcb(inp);
-	bzero(&up->u_start_zero, u_zero_size);
+	bzero(__unbounded_addressof(up->u_start_zero), u_zero_size);
 	INP_WUNLOCK(inp);
 
 	return (0);

sys/netinet6/udp6_usrreq.c

@@ -1038,7 +1038,7 @@ udp6_attach(struct socket *so, int proto, struct thread *td)
 	 */
 	inp->inp_ip_ttl = V_ip_defttl;
 	up = intoudpcb(inp);
-	bzero(&up->u_start_zero, u_zero_size);
+	bzero(__unbounded_addressof(up->u_start_zero), u_zero_size);
 	INP_WUNLOCK(inp);
 	return (0);
 }

sys/netlink/netlink_message_writer.c

@@ -298,7 +298,7 @@
 	errmsg = nlmsg_reserve_data(nw, payload_len, struct nlmsgerr);
 	errmsg->error = error;
 	/* In case of error copy the whole message, else just the header */
-	memcpy(&errmsg->msg, hdr, cap_ack ? sizeof(*hdr) : hdr->nlmsg_len);
+	memcpy(__unbounded_addressof(errmsg->msg), hdr, cap_ack ? sizeof(*hdr) : hdr->nlmsg_len);
 
 	if (npt->err_msg != NULL && nlp->nl_flags & NLF_EXT_ACK)
 		nlattr_add_string(nw, NLMSGERR_ATTR_MSG, npt->err_msg);