In some email I received from itojun@iijlab.net, sie wrote:
> 
> >> 	new code will behave just like traditional 4.4BSDdoes, so packets will
> >> 	be packed like this:
> >> 	- single header mbuf (MHLEN) if len <= MHLEN
> >> 	- header mbuf + normal mbuf (MHLEN + MLEN) if len <= MHLEN + MLEN
> >> 	- single cluster mbuf (MCLBYTES), or multiple cluster mbufs otherwise
> >> 	with the new code, upper-layer headers on a IPv6 packet would exceed
> >> 	the first mbuf easily.  if bpf code looks at first mbuf only, we will
> >> 	fail to catch IPv6 packet by bpf.
> >
> >Hmmm.  I've changed my local bpf_filter() to be like this:
> >
> >        if (buflen == 0) {
> >                m = (struct mbuf *)p;
> >                p = mtod(m, char *);
> >                buflen = m->m_len;		<---
> >        } else
> >                m = NULL;
> 
> >I believe that will work for you ?  Do you want me to send you the
> >bpf_filter.c I'm testing so you can test it with your changes ?
> 
> 	this does not work for me, and other case where bpf insns are
> 	interested in non-first mbuf.  the line marked with arrow is the
> 	prime suspect.  (from code inspection)

The idea is if a mbuf pointer is passed (i.e. buflen == 0) as the buffer,
BPF knows it has a buffer of size "buflen" it can do an easy check with.

If an mbuf has been passed (buflen == 0), but BPF says what we want is in
the next mbuf, then m won't be NULL so it will go the long way though and
call m_*word() to get the data.

I suppose I can send you bpf_filter.c anyway and see if it
works/crashes ? :-)

Darren