>guess which fucking way it goes for every packet given that the call
>from each network card driver will result with "buflen = 0".  I presume
>this hack is here so that the code works for both drivers and when you
>do "tcpdump -r".

	and to share bpf code between kernel and userland.
	(which is rather important, however, is not done so at this moment)

>anyway, now that I've grumbled, I'll probably set about fixing this up
>in one way or another.  for starters, I'd like to see different damn
>prototypes for kernel/non-kernel and then try and optimize it for the
>case where data is going to be in the first mbuf (like 99% of the time).

	just to make sure, please do not nuke cases where data is not on
	first mbuf.  near-future IPv6 change (options PULLDOWN_TEST)
	will choke.

itojun