Probably another bug in hardware VLAN tagging:

if_ether.h has

/* test if any VLAN is configured for this interface */
#define VLAN_ATTACHED(ec)	(&(ec)->ec_nvlans > 0)

-> has higher priority than &, so this code takes the address of
ec->ec_nvlans and compares it against a NULL pointer! I doubt that this is
the itended effect...

What is the purpose of hardware VLAN tagging, anyway? The performance
impact will be rather negative, because searching the VLAN tag in the
linear list of mbuf tags will be probably slower than simply prepending it
to the mbuf. It also seriously limits usability of tcpdump (tcpdump sees
the frames without tags) and the code is often quite dubious, as we have
seen. Wouldn't be better to remove it? Or is it necessary for hardware
checksumming?

Bye	Pavel