Hi,

maybe I'm completely wrong, but I found the following code in=20
udp_usrreq(v1.39):

starting at line 249:
#ifndef PULLDOWN_TEST
	if (m->m_len < iphlen + sizeof(struct udphdr)) {
		if ((m =3D m_pullup(m, iphlen + sizeof(struct udphdr))) =3D=3D 0) {
			udpstat.udps_hdrops++;
			return;
		}
		ip =3D mtod(m, struct ip *);
	}
	uh =3D (struct udphdr *)((caddr_t)ip + iphlen);
#else
	IP6_EXTHDR_GET(uh, struct udphdr *, m, iphlen, sizeof(struct udphdr));
	if (uh =3D=3D NULL) {
		udpstat.udps_hdrops++;
		return;
	}
#endif

isn't it that when the function returns, the mbuffer (m) got lost on the he=
ap?=20
The other times, the "return" is a "goto bad", which frees the mbuffer.

Best regards - J=F6rn