[DevomB]

A proposal, docs only: merge after #311, whose threat-model section ("Compromised net zone") it links. Nothing is built.

What it is. docs/design/net-zone-surface.md, marked as waiting for the owner's decision, like rollback-floor.md. It weighs three ways to narrow what a compromised net zone reaches in the kernel, each with its cost from the tree and Linux 6.18:

• A filter on generic-netlink families. It would leave only nlctrl and nl80211, closing ethtool's setters and other families' namespace-admin commands. Classic-BPF seccomp cannot read the message's family. seccomp's user notification cannot carry a security policy (seccomp_unotify(2)). Landlock in 6.18 has no netlink scope. A BPF LSM needs bpf(2), which the hardening leaves out (hardening.fragment:96-99, LSM list at :202). The only other way is a kernel patch carried through every LTS bump.
• wpa_supplicant's privilege separation. hostap 2.12 still ships CONFIG_PRIVSEP and wpa_priv. It would cost a second build, since the zones suite's access point is the same binary in AP mode; a fourth mapped id; and changes to netzone-init.sh. The privsep wrapper implements only part of the driver interface, so whether SAE, OWE and DPP work through it needs a hwsim trial.
• A time namespace per zone. CONFIG_TIME_NS is already built (6.18 default yes, no fragment unsets it); kryptikd creates none. It would take CLONE_NEWTIME beside CLONE_NEWPID, plus offsets written before pid 1 is forked. It would shift /proc/uptime and /proc/stat's btime (fs/proc/uptime.c:29, stat.c:95-97), but neither the summed idle time nor CLOCK_REALTIME.

Proposed decision: build the time namespace; trial wpa_priv on the hwsim suite before adopting it; leave the family filter, which stays on the threat model's list.

How it is checked. Docs only, so CI and a non-author read; the facts are cited to file and line, in the tree and in 6.18.