[djbclark]

Closes #140.

tsi_stream_getsockopt() (also used for TSI datagram sockets) calls isocket->ops->getsockopt or vsocket->ops->getsockopt without a NULL check, but vsock_dgram_ops and the AF_UNIX proto_ops have no getsockopt. So a getsockopt() at a level other than SOL_SOCKET on a socket proxied through vsock oopses the guest. Minimal trigger, on 6.12.109:

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.connect(("1.1.1.1", 53)); s.send(b"x")
s.getsockopt(socket.IPPROTO_IP, socket.IP_TOS)

This guards both calls and returns -EOPNOTSUPP, which is what do_sock_getsockopt() returns for a socket without getsockopt, the fix proposed in #140. It also sets err for an unexpected status. The setsockopt paths already have this guard.

The change is folded into 0011-Transparent-Socket-Impersonation-implementation.patch, the way #107 did it; only af_tsi.c's hunk and the diffstat change. Checked: the full series applies to linux-6.12.109 with patch -p1 as the Makefile does, 0012 applies without offsets, and net/tsi/af_tsi.o builds for x86_64 with W=1 with no new warnings. I have not booted a guest with it; the same patch is proposed for SIPB's Hyades (https://forgejo.mit.edu/SIPB/hyades/pulls/12), where the repro can be run.

Prepared with an AI coding assistant; reviewed by me.