>> > Are there any interfaces, besides lo0, that are DLT_NULL ?
>> 
>> I've fixed the if_ieee1394subr.c, which is not DLT_NULL actually.
>> 
>> Just looking net/ director only, I've found these files should be fixed.
>> 	if_loop.c
>> 	if_sl.c
>> 	if_strip.c
>> 	if_tun.c
>> 
>> 	if_faith.c
>> 	if_gif.c
>> 	if_stf.c
>> 
>> Note that the last three is the files from KAME and should be fixed in
>> the KAME tree.
>
>and 2 more files found:
>	netinet/ip_gre.c
>	netinet/i4b_ipr.c

i think you have still missed one.

	arch/alpha/a12/if_xb.c

i have to recommend the use of id-utils for this.  allow me to
demonstrate:

% cd /usr/src/sys
% gid DLT_NULL | grep bpfattach
gid DLT_NULL | grep bpfattach
net/if_faith.c:146:     bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int));
net/if_gif.c:171:       bpfattach(&sc->gif_if, DLT_NULL, sizeof(u_int));
net/if_gre.c:159:       bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int32_t));
net/if_loop.c:175:              bpfattach(ifp, DLT_NULL, sizeof(u_int));
net/if_nul.c:202:       bpfattach(ifp, DLT_NULL, sizeof(u_int));
net/if_ppp.c:261:       bpfattach(&sc->sc_if, DLT_NULL, 0);
net/if_stf.c:222:       bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int));
net/if_tun.c:156:       bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
netisdn/i4b_ipr.c:403:          bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int));
netisdn/i4b_ipr.c:405:          bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int));
arch/alpha/a12/if_xb.c:779:     bpfattach(&xbi, DLT_NULL, 0);

>Note that I only check whether it uses dummy mbuf from the stack.
>I'm not sure that the pkthdr is initialized correctly before calling
>bpf_mtap() for other places.

note that i only check for places that call bpfattach() with DLT_NULL,
not anything else.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."