So I've followed this through ...

fr_pullup() isn't doing the correct thing.

Some debugging printfs later...

mp 0xc2541700 m 0xc2541700 0x42 M_LEN 0 plen 243
ip 0xc25417d0 dp 0xc25417f8 hlen 40 dlen 203
MBUF 0xc2541700
  data=0xc25417d0, len=0, type=1, flags=0x42<PKTHDR,LOOP>
  owner=0x20202020, next=0xc2554800, nextpkt=0x0
  leadingspace=152, trailingspace=48, readonly=0
  pktlen=243, rcvif=0xc2a41c00, csum_flags=0x0, csum_data=0x280006, segsz=0
MBUF 0xc2554800
  data=0xcc13f000, len=243, type=1, flags=0x9000001<EXT,EXT_CLUSTER,EXT_RW>
  owner=0xffff, next=0xc2541c00, nextpkt=0x0
  leadingspace=0, trailingspace=1805, readonly=0
  shared=0, ext_buf=0xcc13f000, ext_size=2048, ext_free=0x0, 
ext_arg=0xc04c6ec0
MBUF 0xc2541c00
  data=0xc2541c3c, len=0, type=1, flags=0x40<LOOP>
  owner=0xdeadbeef, next=0x0, nextpkt=0x0
  leadingspace=28, trailingspace=196, readonly=0