bpf_dynptr_slice(9)

💖 NAME 💖

okay bestie, this is bpf_dynptr_slice(9) from the Kernel API Manual, and the name lowkey says it all: bpf_dynptr_slice — Obtain a read-only pointer to the dynptr data. periodt ✨

---

✨ SYNOPSIS ✨

__bpf_kfunc void * bpf_dynptr_slice (const struct bpf_dynptr *p , u64
       offset , void *buffer__nullable , u64 buffer__szk );

---

🎀 ARGUMENTS 🎀

meet the cast, no cap:

• p — the dynptr whose data slice you're trying to retrieve, bestie 💅
• offset — offset into the dynptr, like where you're pointing in the data
• buffer__nullable — a user-provided buffer to copy contents into. it may be NULL (yes, nullable means nullable)
• buffer__szk — size in bytes of the buffer if present. this is the length of the requested slice, and it must be a constant — no vibes-based runtime sizing, okay? 🔥

---

🦋 DESCRIPTION 🦋

so for non-skb and non-xdp type dynptrs, there is literally no difference between bpf_dynptr_slice and bpf_dynptr_data. same energy, same behavior 🫶

if buffer__nullable is NULL, the call will fail if buffer_opt was needed. that's the rule, bestie ⭐

if your intention is to write to the data slice, please use bpf_dynptr_slice_rdwr instead. this one is read-only, so don't try it 💀

the user must check that the returned pointer is not null before using it. like, always. do not skip the null check 😭

please note that in the case of skb and xdp dynptrs, bpf_dynptr_slice does not change the underlying packet data pointers, so a call to bpf_dynptr_slice will not invalidate any ctx->data/data_end pointers in the bpf program. your ctx pointers stay valid, iconic 🌈

---

🌸 RETURN 🌸

NULL if the call failed (eg invalid dynptr), or a pointer to a read-only data slice. and that pointer can be either a direct pointer to the data or a pointer to the user provided buffer, with its contents containing the data, if unable to obtain a direct pointer 👑

so yeah: check for NULL, then vibe with your read-only slice 🍓

---

🔥 SEE ALSO 🔥

also peep the kernel file ./kernel/bpf/helpers.c 👀 and the whole extended friend group:

• bpf_obj_new(9)
• bpf_percpu_obj_new(9)
• bpf_obj_drop(9)
• bpf_percpu_obj_drop(9)
• bpf_refcount_acquire(9)
• bpf_list_push_front(9)
• bpf_list_push_back(9)
• bpf_rbtree_add(9)
• bpf_task_acquire(9)
• bpf_task_release(9)
• bpf_cgroup_acquire(9)
• bpf_cgroup_release(9)
• bpf_cgroup_ancestor(9)
• bpf_cgroup_from_id(9)
• bpf_task_under_cgroup(9)
• bpf_task_get_cgroup1(9)
• bpf_task_from_pid(9)
• bpf_task_from_vpid(9)
• bpf_dynptr_slice_rdwr(9)
• bpf_dynptr_copy(9)
• bpf_dynptr_memset(9)
• bpf_iter_bits_new(9)
• bpf_iter_bits_next(9)
• bpf_iter_bits_destroy(9)
• bpf_copy_from_user_str(9)
• bpf_copy_from_user_task_str(9)
• bpf_strcmp(9)
• bpf_strcasecmp(9)
• bpf_strnchr(9)
• bpf_strchr(9)
• bpf_strchrnul(9)
• bpf_strrchr(9)
• bpf_strnlen(9)
• bpf_strlen(9)
• bpf_strspn(9)
• bpf_strcspn(9)
• bpf_strstr(9)
• bpf_strcasestr(9)
• bpf_strnstr(9)
• bpf_strncasestr(9)
• bpf_lookup_user_key(9)
• bpf_lookup_system_key(9)
• bpf_key_put(9)
• bpf_verify_pkcs7_signature(9)
• bpf_task_work_schedule_signal(9)
• bpf_task_work_schedule_resume(9)
• bpf_timer_cancel_async(9)

---

made with love in ./kernel/bpf, October 2026 edition, for bpf_dynptr_slice(9) — bye bestie, go check that pointer 💅🎀