Further in followup to the ip_fragment() bug, at the crash, off = 1500, len = 1480 and ip->ip_len = 21248. So m_copym() is being called with off > len.
Dave. -- ============================================================================ |David Gilbert, Independent Contractor. | Two things can only be | |Mail: [EMAIL PROTECTED] | equal if and only if they | |http://daveg.ca | are precisely opposite. | =========================================================GLO================ _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
