diff --git a/meta-phosphor/recipes-core/systemd/systemd/0001-socket-util-introduce-CMSG_SPACE_TIMEVAL-TIMESPEC-ma.patch b/meta-phosphor/recipes-core/systemd/systemd/0001-socket-util-introduce-CMSG_SPACE_TIMEVAL-TIMESPEC-ma.patch
new file mode 100644
index 0000000..3e376ed
--- /dev/null
+++ b/meta-phosphor/recipes-core/systemd/systemd/0001-socket-util-introduce-CMSG_SPACE_TIMEVAL-TIMESPEC-ma.patch
@@ -0,0 +1,89 @@
+diff --git a/src/basic/socket-util.h b/src/basic/socket-util.h
+index f92e425fd6..09e606614c 100644
+--- a/src/basic/socket-util.h
++++ b/src/basic/socket-util.h
+@@ -277,6 +277,28 @@ static inline int getsockopt_int(int fd, int level, int optname, int *ret) {
+ int socket_bind_to_ifname(int fd, const char *ifname);
+ int socket_bind_to_ifindex(int fd, int ifindex);
+ 
++/* Define a 64bit version of timeval/timespec in any case, even on 32bit userspace. */
++struct timeval_large {
++        uint64_t tvl_sec, tvl_usec;
++};
++struct timespec_large {
++        uint64_t tvl_sec, tvl_nsec;
++};
++
++/* glibc duplicates timespec/timeval on certain 32bit archs, once in 32bit and once in 64bit.
++ * See __convert_scm_timestamps() in glibc source code. Hence, we need additional buffer space for them
++ * to prevent from recvmsg_safe() returning -EXFULL. */
++#define CMSG_SPACE_TIMEVAL                                              \
++        ((sizeof(struct timeval) == sizeof(struct timeval_large)) ?     \
++         CMSG_SPACE(sizeof(struct timeval)) :                           \
++         CMSG_SPACE(sizeof(struct timeval)) +                           \
++         CMSG_SPACE(sizeof(struct timeval_large)))
++#define CMSG_SPACE_TIMESPEC                                             \
++        ((sizeof(struct timespec) == sizeof(struct timespec_large)) ?   \
++         CMSG_SPACE(sizeof(struct timespec)) :                          \
++         CMSG_SPACE(sizeof(struct timespec)) +                          \
++         CMSG_SPACE(sizeof(struct timespec_large)))
++
+ ssize_t recvmsg_safe(int sockfd, struct msghdr *msg, int flags);
+ 
+ int socket_get_family(int fd, int *ret);
+diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
+index a0695ec519..abd52f7c14 100644
+--- a/src/journal/journald-server.c
++++ b/src/journal/journald-server.c
+@@ -1277,7 +1277,7 @@ int server_process_datagram(
+          * identical to NAME_MAX. For now we use that, but this should be updated one day when the final
+          * limit is known. */
+         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct ucred)) +
+-                         CMSG_SPACE(sizeof(struct timeval)) +
++                         CMSG_SPACE_TIMEVAL +
+                          CMSG_SPACE(sizeof(int)) + /* fd */
+                          CMSG_SPACE(NAME_MAX) /* selinux label */) control;
+ 
+diff --git a/src/libsystemd-network/icmp6-util.c b/src/libsystemd-network/icmp6-util.c
+index 67c6b55d84..823be0f275 100644
+--- a/src/libsystemd-network/icmp6-util.c
++++ b/src/libsystemd-network/icmp6-util.c
+@@ -149,7 +149,7 @@ int icmp6_receive(int fd, void *buffer, size_t size, struct in6_addr *ret_dst,
+                   triple_timestamp *ret_timestamp) {
+ 
+         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int)) + /* ttl */
+-                         CMSG_SPACE(sizeof(struct timeval))) control;
++                         CMSG_SPACE_TIMEVAL) control;
+         struct iovec iov = {};
+         union sockaddr_union sa = {};
+         struct msghdr msg = {
+@@ -186,7 +186,6 @@ int icmp6_receive(int fd, void *buffer, size_t size, struct in6_addr *ret_dst,
+ 
+         /* namelen == 0 only happens when running the test-suite over a socketpair */
+ 
+-        assert(!(msg.msg_flags & MSG_CTRUNC));
+         assert(!(msg.msg_flags & MSG_TRUNC));
+ 
+         CMSG_FOREACH(cmsg, &msg) {
+diff --git a/src/timesync/timesyncd-manager.c b/src/timesync/timesyncd-manager.c
+index 9d874cfc8a..648e804105 100644
+--- a/src/timesync/timesyncd-manager.c
++++ b/src/timesync/timesyncd-manager.c
+@@ -412,7 +412,7 @@ static int manager_receive_response(sd_event_source *source, int fd, uint32_t re
+                 .iov_base = &ntpmsg,
+                 .iov_len = sizeof(ntpmsg),
+         };
+-        CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct timespec))) control;
++        CMSG_BUFFER_TYPE(CMSG_SPACE_TIMESPEC) control;
+         union sockaddr_union server_addr;
+         struct msghdr msghdr = {
+                 .msg_iov = &iov,
+@@ -467,6 +467,8 @@ static int manager_receive_response(sd_event_source *source, int fd, uint32_t re
+ 
+                 switch (cmsg->cmsg_type) {
+                 case SCM_TIMESTAMPNS:
++                        assert(cmsg->cmsg_len == CMSG_LEN(sizeof(struct timespec)));
++
+                         recv_time = (struct timespec *) CMSG_DATA(cmsg);
+                         break;
+                 }
diff --git a/meta-phosphor/recipes-core/systemd/systemd_249.3.bbappend b/meta-phosphor/recipes-core/systemd/systemd_249.3.bbappend
new file mode 100644
index 0000000..6ab1a6a
--- /dev/null
+++ b/meta-phosphor/recipes-core/systemd/systemd_249.3.bbappend
@@ -0,0 +1,6 @@
+# Backport a fix that is only in main, otherwise all received RAs will fail
+# to be parsed.
+SRC_URI += "file://0001-socket-util-introduce-CMSG_SPACE_TIMEVAL-TIMESPEC-ma.patch"
+
+# Pin to v249.4 to fix systemd-networkd segfaults.
+SRCREV = "4d8fd88b9641fce81272f60f556543f713175403"