From e8d6cd9b58479fbbb70ef9e48be16257768f4c3d Mon Sep 17 00:00:00 2001
From: JackDoan <me@jackdoan.com>
Date: Wed, 14 Oct 2026 15:32:36 -0500
Subject: [PATCH] Size the buffers of a handshake packet sent through a relay
 for the packet, not the mtu

---
 handshake_manager_pq.go | 12 ++++++++++--
 relay_manager.go        |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/handshake_manager_pq.go b/handshake_manager_pq.go
index 08373b97..2e92a2da 100644
--- a/handshake_manager_pq.go
+++ b/handshake_manager_pq.go
@@ -289,11 +289,19 @@ func (hm *HandshakeManager) relayEstablished(target netip.Addr, relayHI *HostInf
 	f := hm.f
 	hh.hostinfo.logger(hm.l).Info("Send handshake via new relay", "relay", relayHI.vpnAddrs[0])
 	_ = hm.sendFragmented(now, later, func(p []byte) error {
-		f.SendVia(relayHI, relay, p, make([]byte, 12), make([]byte, mtu), false, 0)
+		f.sendHandshakeVia(relayHI, relay, p)
 		return nil
 	})
 }
 
+// sendHandshakeVia sends a handshake packet through a relay, with buffers sized
+// for the packet rather than the mtu: a relayed post-quantum handshake is
+// dozens of fragments.
+func (f *Interface) sendHandshakeVia(via *HostInfo, relay *Relay, p []byte) {
+	out := make([]byte, header.Len+len(p)+via.ConnectionState.eKey.Overhead())
+	f.SendVia(via, relay, p, make([]byte, 12), out, false, 0)
+}
+
 // buildPQAttempt creates the initiator's PQ Machine and msg1 sender. A node with
 // a v3 certificate speaks the hybrid handshake for its suite's KEM, anyone else
 // the ephemeral KEM one.
@@ -824,7 +832,7 @@ func (hm *HandshakeManager) sendTo(via ViaSender) func([]byte) error {
 		if via.relay == nil {
 			return errors.New("both addr and via.relay are nil")
 		}
-		f.SendVia(via.relayHI, via.relay, p, make([]byte, 12), make([]byte, mtu), false, 0)
+		f.sendHandshakeVia(via.relayHI, via.relay, p)
 		return nil
 	}
 }
diff --git a/relay_manager.go b/relay_manager.go
index 6dab7f45..5c012a86 100644
--- a/relay_manager.go
+++ b/relay_manager.go
@@ -163,7 +163,7 @@ func (rm *relayManager) StartRelays(f *Interface, vpnIp netip.Addr, hh *Handshak
 		case Established:
 			hl.Log(context.Background(), level, "Send handshake via relay", "relay", relay.String())
 			_ = f.handshakeManager.sendFragmented(now, later, func(p []byte) error {
-				f.SendVia(relayHostInfo, existingRelay, p, make([]byte, 12), make([]byte, mtu), false, 0)
+				f.sendHandshakeVia(relayHostInfo, existingRelay, p)
 				return nil
 			})
 		case Disestablished: