x/net/icmp: PacketConn.ReadFrom on an unprivileged PacketConn on darwin returns the entire IP packet

[magisterquis]

What version of Go are you using (go version)?

$ go version
go version go1.16.6 openbsd/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/stuart/.cache/go-build"
GOENV="/home/stuart/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="openbsd"
GOINSECURE=""
GOMODCACHE="/home/stuart/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="openbsd"
GOPATH="/home/stuart/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/home/stuart/.goroot"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/home/stuart/.goroot/pkg/tool/openbsd_amd64"
GOVCS=""
GOVERSION="go1.16.6"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="0"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1897681582=/tmp/go-build -gno-record-gcc-switches"

What did you do?

https://play.golang.org/p/oNQqxusHBf1

The program sends a ping first with a privileged socket and then with an unprivileged socket.

What did you expect to see?

I expect to see the returned ICMP payloads to be fairly similar. On Linux, they are.
Linux:

2021/07/24 10:43:11 [udp4] Read 8 bytes: 0000ba9700274541
2021/07/24 10:43:11 [ip4:icmp] Read 8 bytes: 000000d37f967f96

What did you see instead?

The read from the unprivileged socket on Darwin included the IP header before the ICMP header.
Darwin:

2021/07/24 12:43:43 [udp4] Read 28 bytes: 45600800000000007001269d080808080a0209d30000fcff01800180
2021/07/24 12:43:43 [ip4:icmp] Read 8 bytes: 0000c75e9c509c50

This seems due to the check in https://cs.opensource.google/go/x/net/+/853a4619:icmp/endpoint.go;l=54 which (apparently) doesn't apply to unprivileged sockets.