>> 	  m_pulldown() does not have the problem (uses mbuf).
>Instead, it has another problem: it can fail and lose the packet in the
>process.

	if there's not enough room in mbuf pool, everyone fails (not only
	m_pulldown).  on the other side, if you use stack too much (for
	buffer used by m_extractd) kernel stack blows (i did it in ipsec
	support - blowfish uses big key table).

>> 	m_extract(m, off + sizeof(struct foohdr),
>> 		f->len - sizeof(struct foohdr), 8, buf + sizeof(struct foohdr));
>Why would you *ever* call m_extract and ignore the return value?  One
>of us is missing something big here.

	sorry it must be "f = m_extract"...

>But why do you insist on having the fixed-size and variable-size
>portions of foohdr end up contiguous in memory?

	for example, see sys/netinet6/icmp6.h and icmp6_input().
	we have common header for all icmp6 types (icmp6_hdr), and structures
	that EXTENDS those (like nd_redirect).  moreover, some of them is
	followed by variable length options.
	do you really want to have separate structures allocated onto the
	stack?
	(BTW icmp6.h is based on RFC2292)

itojun