3 files changed, 66 insertions, 10 deletions
diff --git a/pkg/abi/linux/linux_abi_autogen_unsafe.go b/pkg/abi/linux/linux_abi_autogen_unsafe.go
index 15ec4e8b6..7bc581c39 100644
--- a/pkg/abi/linux/linux_abi_autogen_unsafe.go
+++ b/pkg/abi/linux/linux_abi_autogen_unsafe.go
@@ -66,6 +66,7 @@ var _ marshal.Marshallable = (*Inet6Addr)(nil)
 var _ marshal.Marshallable = (*InetAddr)(nil)
 var _ marshal.Marshallable = (*ItimerVal)(nil)
 var _ marshal.Marshallable = (*Itimerspec)(nil)
+var _ marshal.Marshallable = (*KernelIP6TEntry)(nil)
 var _ marshal.Marshallable = (*KernelIP6TGetEntries)(nil)
 var _ marshal.Marshallable = (*KernelIPTEntry)(nil)
 var _ marshal.Marshallable = (*KernelIPTGetEntries)(nil)
@@ -6515,6 +6516,61 @@ func (i *IP6TReplace) WriteTo(writer io.Writer) (int64, error) {
 
 // Packed implements marshal.Marshallable.Packed.
 //go:nosplit
+func (ke *KernelIP6TEntry) Packed() bool {
+    // Type KernelIP6TEntry is dynamic so it might have slice/string headers. Hence, it is not packed.
+    return false
+}
+
+// MarshalUnsafe implements marshal.Marshallable.MarshalUnsafe.
+func (ke *KernelIP6TEntry) MarshalUnsafe(dst []byte) {
+    // Type KernelIP6TEntry doesn't have a packed layout in memory, fallback to MarshalBytes.
+    ke.MarshalBytes(dst)
+}
+
+// UnmarshalUnsafe implements marshal.Marshallable.UnmarshalUnsafe.
+func (ke *KernelIP6TEntry) UnmarshalUnsafe(src []byte) {
+    // Type KernelIP6TEntry doesn't have a packed layout in memory, fallback to UnmarshalBytes.
+    ke.UnmarshalBytes(src)
+}
+
+// CopyOutN implements marshal.Marshallable.CopyOutN.
+//go:nosplit
+func (ke *KernelIP6TEntry) CopyOutN(cc marshal.CopyContext, addr hostarch.Addr, limit int) (int, error) {
+    // Type KernelIP6TEntry doesn't have a packed layout in memory, fall back to MarshalBytes.
+    buf := cc.CopyScratchBuffer(ke.SizeBytes()) // escapes: okay.
+    ke.MarshalBytes(buf) // escapes: fallback.
+    return cc.CopyOutBytes(addr, buf[:limit]) // escapes: okay.
+}
+
+// CopyOut implements marshal.Marshallable.CopyOut.
+//go:nosplit
+func (ke *KernelIP6TEntry) CopyOut(cc marshal.CopyContext, addr hostarch.Addr) (int, error) {
+    return ke.CopyOutN(cc, addr, ke.SizeBytes())
+}
+
+// CopyIn implements marshal.Marshallable.CopyIn.
+//go:nosplit
+func (ke *KernelIP6TEntry) CopyIn(cc marshal.CopyContext, addr hostarch.Addr) (int, error) {
+    // Type KernelIP6TEntry doesn't have a packed layout in memory, fall back to UnmarshalBytes.
+    buf := cc.CopyScratchBuffer(ke.SizeBytes()) // escapes: okay.
+    length, err := cc.CopyInBytes(addr, buf) // escapes: okay.
+    // Unmarshal unconditionally. If we had a short copy-in, this results in a
+    // partially unmarshalled struct.
+    ke.UnmarshalBytes(buf) // escapes: fallback.
+    return length, err
+}
+
+// WriteTo implements io.WriterTo.WriteTo.
+func (ke *KernelIP6TEntry) WriteTo(writer io.Writer) (int64, error) {
+    // Type KernelIP6TEntry doesn't have a packed layout in memory, fall back to MarshalBytes.
+    buf := make([]byte, ke.SizeBytes())
+    ke.MarshalBytes(buf)
+    length, err := writer.Write(buf)
+    return int64(length), err
+}
+
+// Packed implements marshal.Marshallable.Packed.
+//go:nosplit
 func (ke *KernelIP6TGetEntries) Packed() bool {
     // Type KernelIP6TGetEntries is dynamic so it might have slice/string headers. Hence, it is not packed.
     return false
diff --git a/pkg/abi/linux/netfilter.go b/pkg/abi/linux/netfilter.go
index 775bbc759..35c632168 100644
--- a/pkg/abi/linux/netfilter.go
+++ b/pkg/abi/linux/netfilter.go
@@ -145,13 +145,13 @@ func (ke *KernelIPTEntry) SizeBytes() int {
 
 // MarshalBytes implements marshal.Marshallable.MarshalBytes.
 func (ke *KernelIPTEntry) MarshalBytes(dst []byte) {
-	ke.Entry.MarshalBytes(dst)
+	ke.Entry.MarshalUnsafe(dst)
 	ke.Elems.MarshalBytes(dst[ke.Entry.SizeBytes():])
 }
 
 // UnmarshalBytes implements marshal.Marshallable.UnmarshalBytes.
 func (ke *KernelIPTEntry) UnmarshalBytes(src []byte) {
-	ke.Entry.UnmarshalBytes(src)
+	ke.Entry.UnmarshalUnsafe(src)
 	ke.Elems.UnmarshalBytes(src[ke.Entry.SizeBytes():])
 }
 
@@ -440,7 +440,7 @@ func (ke *KernelIPTGetEntries) SizeBytes() int {
 
 // MarshalBytes implements marshal.Marshallable.MarshalBytes.
 func (ke *KernelIPTGetEntries) MarshalBytes(dst []byte) {
-	ke.IPTGetEntries.MarshalBytes(dst)
+	ke.IPTGetEntries.MarshalUnsafe(dst)
 	marshalledUntil := ke.IPTGetEntries.SizeBytes()
 	for i := range ke.Entrytable {
 		ke.Entrytable[i].MarshalBytes(dst[marshalledUntil:])
@@ -450,7 +450,7 @@ func (ke *KernelIPTGetEntries) MarshalBytes(dst []byte) {
 
 // UnmarshalBytes implements marshal.Marshallable.UnmarshalBytes.
 func (ke *KernelIPTGetEntries) UnmarshalBytes(src []byte) {
-	ke.IPTGetEntries.UnmarshalBytes(src)
+	ke.IPTGetEntries.UnmarshalUnsafe(src)
 	unmarshalledUntil := ke.IPTGetEntries.SizeBytes()
 	for i := range ke.Entrytable {
 		ke.Entrytable[i].UnmarshalBytes(src[unmarshalledUntil:])
diff --git a/pkg/abi/linux/netfilter_ipv6.go b/pkg/abi/linux/netfilter_ipv6.go
index b953e62dc..f7c70b430 100644
--- a/pkg/abi/linux/netfilter_ipv6.go
+++ b/pkg/abi/linux/netfilter_ipv6.go
@@ -86,7 +86,7 @@ func (ke *KernelIP6TGetEntries) SizeBytes() int {
 
 // MarshalBytes implements marshal.Marshallable.MarshalBytes.
 func (ke *KernelIP6TGetEntries) MarshalBytes(dst []byte) {
-	ke.IPTGetEntries.MarshalBytes(dst)
+	ke.IPTGetEntries.MarshalUnsafe(dst)
 	marshalledUntil := ke.IPTGetEntries.SizeBytes()
 	for i := range ke.Entrytable {
 		ke.Entrytable[i].MarshalBytes(dst[marshalledUntil:])
@@ -96,7 +96,7 @@ func (ke *KernelIP6TGetEntries) MarshalBytes(dst []byte) {
 
 // UnmarshalBytes implements marshal.Marshallable.UnmarshalBytes.
 func (ke *KernelIP6TGetEntries) UnmarshalBytes(src []byte) {
-	ke.IPTGetEntries.UnmarshalBytes(src)
+	ke.IPTGetEntries.UnmarshalUnsafe(src)
 	unmarshalledUntil := ke.IPTGetEntries.SizeBytes()
 	for i := range ke.Entrytable {
 		ke.Entrytable[i].UnmarshalBytes(src[unmarshalledUntil:])
@@ -149,8 +149,8 @@ type IP6TEntry struct {
 const SizeOfIP6TEntry = 168
 
 // KernelIP6TEntry is identical to IP6TEntry, but includes the Elems field.
-// KernelIP6TEntry itself is not Marshallable but it implements some methods of
-// marshal.Marshallable that help in other implementations of Marshallable.
+//
+// +marshal dynamic
 type KernelIP6TEntry struct {
 	Entry IP6TEntry
 
@@ -168,13 +168,13 @@ func (ke *KernelIP6TEntry) SizeBytes() int {
 
 // MarshalBytes implements marshal.Marshallable.MarshalBytes.
 func (ke *KernelIP6TEntry) MarshalBytes(dst []byte) {
-	ke.Entry.MarshalBytes(dst)
+	ke.Entry.MarshalUnsafe(dst)
 	ke.Elems.MarshalBytes(dst[ke.Entry.SizeBytes():])
 }
 
 // UnmarshalBytes implements marshal.Marshallable.UnmarshalBytes.
 func (ke *KernelIP6TEntry) UnmarshalBytes(src []byte) {
-	ke.Entry.UnmarshalBytes(src)
+	ke.Entry.UnmarshalUnsafe(src)
 	ke.Elems.UnmarshalBytes(src[ke.Entry.SizeBytes():])
 }