http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/002_in6bind.patch.sig
002: SECURITY FIX: March 16, 2016 All architectures Insufficient checks in IPv6 socket binding and UDP IPv6 option processing allow a local user to send UDP packets with a source (IPv6 address + port) already reserved by another user. This hasn't been committed to OpenBSD_5_9. Maybe an oversight. Ian McWilliam