pub const KRB5P_MAX_WRITE_DATA: usize = 3584;Expand description
Maximum file data size for krb5p compound RPC bypass (bytes).
The kernel’s gss_krb5_unwrap produces garbled output when priv_bytes (4-byte seq_num + compound_args) exceeds 3,952 bytes (247 x 16 AES blocks). With ~260 bytes of non-data compound overhead, this limits write data to ~3,688 bytes. We use 3,584 (3.5KB) as a conservative threshold.
Files exceeding this are routed directly to VFS sendfile, avoiding the failed-compound + session-recovery penalty (~25ms per file).
Empirical: priv_bytes=3,952 -> NFS4_OK; priv_bytes=3,964 -> NFS4ERR_BAD_STATEID. GSS wrap overhead is constant at 72 bytes regardless of input size. AUTH_SYS compounds of the same size succeed without error.