fixes:

 - don't try and add a PDU trailer (or TBD for that matter) to an M_EXT
   mbuf.   when M_EXT is set, the data area of the mbuf can be shared
   with other mbufs (see m_copym()), and writing to one M_EXT mbuf may
   invalidate another M_EXT mbuf (saw this with PDU trailers).

 - be sure to validate the length value from the PDU trailer so that it
   doesn't throw us out of sync with the chip (fixes yet another source
   of the dread "en_service: id mismatch" panic).

 - on recv, don't bother allocating an mbuf if mlen is zero since we are
   only going to toss the data anyway.

0 files changed, 0 insertions, 0 deletions