Part of the problem, as I see it, with the code that calls bpf_mtap()
from things like if_tun.c is that the mbuf passed is not properly
initialised and as it is a local variable, picking up whatever junk
is on the stack, i.e.:
...
                struct mbuf m;
                u_int32_t af = dst->sa_family;

                m.m_next = m0;
                m.m_len = sizeof(af);
                m.m_data = (char *)⁡

                bpf_mtap(ifp->if_bpf, &m);
...

So, if there was something like a "m.m_pkthdr.flags = 0" here, then
it would have been safe to check for M_PKTHDR being set in bpf_mtap().

Darren