The spec defines encap-type (unspec / direct / gue), but no attribute references it, so the definition exists only to emit FOU_ENCAP_* into the uAPI header - while FOU_ATTR_TYPE is exactly that value space: fou_create() switches on FOU_ENCAP_DIRECT / FOU_ENCAP_GUE and returns -EINVAL for anything else. Python YNL could not accept or display the names and the generated C exposed a raw __u8 setter. The global policy entry becomes NLA_POLICY_MAX(NLA_U8, 2). For add that only moves the existing fou_create() rejection earlier; del and get ignore FOU_ATTR_TYPE altogether, so a bogus type there now fails validation instead of being dropped on the floor. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Link: https://patch.msgid.link/20260904191412.3872344-4-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>