untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24Jx7MloiJDF+ZEh1syk0eQbq+smrbfCSAlgRMDaV4daGMy7C9KwlylkV0/5WWb1qXW/pew21yAeegC+djx40JQ4=

OpenBSD 6.6 errata 026, May 10, 2020:

ospfd could generate corrupt OSPF Router (Type 1) LSAs in certain situations.

Apply by doing:
    signify -Vep /etc/signify/openbsd-66-base.pub -x 026_ospfd_lsa.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install ospfd:
    cd /usr/src/usr.sbin/ospfd
    make obj
    make clean
    make
    make install

Index: usr.sbin/ospfd/lsupdate.c
===================================================================
RCS file: /cvs/src/usr.sbin/ospfd/lsupdate.c,v
retrieving revision 1.46
diff -u -p -r1.46 lsupdate.c
--- usr.sbin/ospfd/lsupdate.c	15 Jul 2019 18:26:39 -0000	1.46
+++ usr.sbin/ospfd/lsupdate.c	6 May 2020 20:10:02 -0000
@@ -175,8 +175,8 @@ int
 add_ls_update(struct ibuf *buf, struct iface *iface, void *data, u_int16_t len,
     u_int16_t older)
 {
-	void		*lsage;
-	u_int16_t	 age;
+	size_t		ageoff;
+	u_int16_t	age;
 
 	if ((size_t)iface->mtu < sizeof(struct ip) + sizeof(struct ospf_hdr) +
 	    sizeof(u_int32_t) + ibuf_size(buf) + len + MD5_DIGEST_LENGTH) {
@@ -186,7 +186,7 @@ add_ls_update(struct ibuf *buf, struct i
 			return (0);
 	}
 
-	lsage = ibuf_reserve(buf, 0);
+	ageoff = ibuf_size(buf);
 	if (ibuf_add(buf, data, len)) {
 		log_warn("add_ls_update");
 		return (0);
@@ -198,7 +198,7 @@ add_ls_update(struct ibuf *buf, struct i
 	if ((age += older + iface->transmit_delay) >= MAX_AGE)
 		age = MAX_AGE;
 	age = htons(age);
-	memcpy(lsage, &age, sizeof(age));
+	memcpy(ibuf_seek(buf, ageoff, sizeof(age)), &age, sizeof(age));
 
 	return (1);
 }