EDK II NetworkPkg (IPv6 Destination Options header, PadN option parsing): Same shape as the unknown-option hang but

Impact

Same shape as the unknown-option hang but reached through the PadN option, which is trivially craftable. One packet parks a node in firmware forever. In a netboot-driven cluster this is a cheap way to deny an operator their fleet during a reprovisioning window, and the failure looks like a hardware fault rather than an attack.

Who can reach it

Unauthenticated, on-link attacker sending crafted IPv6 packets to nodes during network boot.

What to do

Firmware flash from the server OEM, one reboot per node. No runtime fix. Practical interim control is to disable IPv6 network boot in the UEFI setup (a config change, deployable via the OEM's remote BIOS-settings tooling without a flash) and to keep the provisioning VLAN reachable only from the deployment controllers.

References