CVE-2026-40199: perlPackages.NetCIDRLite, backport upstream fix (no version bump)

[jasonodoom]

⚠️ EXPERIMENTAL source-backport — NOT a version bump

This PR authors the upstream fix as an in-tree patch against the current nixpkgs version (no version bump). An agent generated it; a cross-family reviewer verified it transcribes the upstream commit, and a cert proved the bundled reproducer goes red→green. A human maintainer must still confirm sufficiency before merging:

• This applies the COMPLETE upstream fix, not one of several required commits.
• The backported hunk matches the upstream fix commit(s):
  • stigtsp/Net-CIDR-Lite@b7166b1
• Reviewed the cert evidence (reproducer red→green) for CVE-2026-40199.

Opened as a draft deliberately — mark Ready-for-review only after the boxes above are checked.

---

Evidence: CVE-2026-40199 (human-review-required) trace bundle 64b08e1346e3e798

• Rekor entry: https://rekor.sigstore.dev/api/v1/log/entries?logIndex=2727558663
• Workflow identity: https://github.com/Ad-Astra-Computing/trace/.github/workflows/steward.yml@refs/heads/main
• OIDC issuer: https://token.actions.githubusercontent.com
• Cert run: https://github.com/Ad-Astra-Computing/trace/actions/runs/33976733752
• nixpkgs rev: ff166608d2eb81d041faf0e8d39ca6a02c9fb24b

Verify locally

gh run download <run-id> --name steward-smoke-<bundle> --dir ./artifact
trace bundle verify ./artifact  # bundle_id=64b08e1346e3e798

Generated by trace.

[jasonodoom]

Comparison against the upstream fix

Transcription lane (this PR's payload). The added and removed code lines of the embedded patch (lib/Net/CIDR/Lite.pm) are identical to the upstream fix commit Net-CIDR-Lite b7166b1f, normalized for whitespace. The cross-family Reviewer attested this; the check here was recomputed independently against the bundle's upstream-fix.patch. The Linux cert (trace run 33976733752) built perlPackages.NetCIDRLite at the pinned revision with and without the patch: the unpatched arm mis-parsed the IPv4-mapped address and fired the discriminator, the patched arm was clean.

Blind-authoring lane (separate measurement, not this payload). When the same CVE was given to claude-opus-4-8 with only the vulnerability description and the pre-fix source, never the upstream patch, the graded result against the human fix was GOLD: a conditional form of the same substring fix that is equivalent when the IPv4 part is empty. Report: trace data/reports/authoring-accuracy-vs-human-2026-09-04.json.

This is one of the cases where the blind lane got the fix right unaided. The PR ships the transcribed upstream fix because that is what the Reviewer can attest line by line.