> 	Would there be any sense in defining a macro to be used to
> 	initialise any 'fake mbuf', so we can centralise exactly
> 	what needs to happen to them?

In order to do it, we should specify 'fake mbuf' and assign a mbuf type
for it.  It would be:
	- the contents is volatile and cannot be refered after returning
	  the function.
	- the data buffer is read only,
	  # Should it be whole mbuf including mbuf header is read only?
	- cannot be freed

After thinking these tricks, I'd rather prefer adding new API to bpf,
such as,
	void bpf_mtap2(caddr_t bpf, caddr_t hdr, int hdrlen, struct mbuf *m);
# sorry that I don't have ability in naming.

Is there any place other than bpf where 'fake mbuf' is used?

Atsushi Onoe