untrusted comment: verify with openbsd-76-base.pub
RWTkuwn4mbq8onyzue4hfBLbIEo0jGopFMVcjqkmx1ZFHBG5tPYbM1XIR3xz8g/lY6+DkTXhMNQyIOD/RNDjotgeaO6PyKgC4QM=

OpenBSD 7.6 errata 017, June 17, 2025:

When using syncookies in pf(4), new TCP connections could run into
timeout due to integer underflow.

Apply by doing:
    signify -Vep /etc/signify/openbsd-76-base.pub -x 017_pfsyncook.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/net/pf.c
===================================================================
RCS file: /cvs/src/sys/net/pf.c,v
diff -u -p -r1.1205 pf.c
--- sys/net/pf.c	4 Sep 2024 07:54:52 -0000	1.1205
+++ sys/net/pf.c	3 Jun 2025 13:54:46 -0000
@@ -382,7 +382,7 @@ pf_set_protostate(struct pf_state *st, i
 	    !(TCPS_HAVEESTABLISHED(st->src.state) ||
 	    st->src.state == TCPS_CLOSED) &&
 	    (TCPS_HAVEESTABLISHED(newstate) || newstate == TCPS_CLOSED))
-		pf_status.states_halfopen--;
+		atomic_dec_int(&pf_status.states_halfopen);
 
 	st->src.state = newstate;
 }
@@ -4677,7 +4677,7 @@ pf_create_state(struct pf_pdesc *pd, str
 		pf_set_protostate(st, PF_PEER_SRC, TCPS_SYN_SENT);
 		pf_set_protostate(st, PF_PEER_DST, TCPS_CLOSED);
 		st->timeout = PFTM_TCP_FIRST_PACKET;
-		pf_status.states_halfopen++;
+		atomic_inc_int(&pf_status.states_halfopen);
 		break;
 	case IPPROTO_UDP:
 		pf_set_protostate(st, PF_PEER_SRC, PFUDPS_SINGLE);