The following reply was made to PR kern/29531; it has been noted by GNATS.

From: Darren Reed <darrenr@NetBSD.org>
To: apz-list@2304.org
Cc: gnats-bugs@netbsd.org, martin@netbsd.org, arto@selonen.org
Subject: Re: kern/29531
Date: Sun, 27 Feb 2005 17:08:26 +0000

 If you're running -current and seeing a panic message with m_copydata,
 please apply the patch below to /sys/kern/uipc_mbuf.c.
 
 I'm after more information as, by all counts, everything should be fine.
 
 Darren
 
 *** uipc_mbuf.c.dist	2005-01-25 08:25:09.000000000 +1100
 --- uipc_mbuf.c	2005-02-21 03:57:01.000000000 +1100
 ***************
 *** 670,691 ****
   void
   m_copydata(struct mbuf *m, int off, int len, void *vp)
   {
   	unsigned count;
   	char *cp = vp;
   
 ! 	if (off < 0 || len < 0)
   		panic("m_copydata: off %d, len %d", off, len);
   	while (off > 0) {
 ! 		if (m == 0)
   			panic("m_copydata: m == 0, off %d", off);
   		if (off < m->m_len)
   			break;
   		off -= m->m_len;
   		m = m->m_next;
   	}
   	while (len > 0) {
 ! 		if (m == 0)
   			panic("m_copydata: m == 0, len %d", len);
   		count = min(m->m_len - off, len);
   		memcpy(cp, mtod(m, caddr_t) + off, count);
   		len -= count;
 --- 670,714 ----
   void
   m_copydata(struct mbuf *m, int off, int len, void *vp)
   {
 + 	int _off = off, _len = len;
 + 	struct mbuf *_m = m;
 + 	void *_vp = vp;
   	unsigned count;
   	char *cp = vp;
   
 ! 	if (off < 0 || len < 0) {
 ! 		printf("m_copydata(%p,%d,%d,%p)\n", _m, _off, _len, _vp);
   		panic("m_copydata: off %d, len %d", off, len);
 + 	}
   	while (off > 0) {
 ! 		if (m == 0) {
 ! 			struct mbuf *n;
 ! 			int l;
 ! 
 ! 			for (l = 0, n = m; n != NULL; n = n->m_next)
 ! 				l += n->m_len;
 ! 			printf("m_copydata(%p[%x,%d/%d],%d,%d,%p)\n",
 ! 				_m, _m->m_flags, _m->m_pkthdr.len, l,
 ! 				_off, _len, _vp);
   			panic("m_copydata: m == 0, off %d", off);
 + 		}
   		if (off < m->m_len)
   			break;
   		off -= m->m_len;
   		m = m->m_next;
   	}
   	while (len > 0) {
 ! 		if (m == 0) {
 ! 			struct mbuf *n;
 ! 			int l;
 ! 
 ! 			for (l = 0, n = m; n != NULL; n = n->m_next)
 ! 				l += n->m_len;
 ! 			printf("m_copydata(%p[%x,%d/%d],%d,%d,%p)\n",
 ! 				_m, _m->m_flags, _m->m_pkthdr.len, l,
 ! 				_off, _len, _vp);
   			panic("m_copydata: m == 0, len %d", len);
 + 		}
   		count = min(m->m_len - off, len);
   		memcpy(cp, mtod(m, caddr_t) + off, count);
   		len -= count;