>> 	for this particular case (sys/net/if_gre.c) this portion is adjusting
>> 	length field of encapsulating IP header, which was allocated by
>> 	MGETHDR.  therefore it is totally safe.
>All other case are also know to be safe?

	i need to double-check reasssembly case.  other than that, it should
	be safe.  i don't have any objection in having m_pullup() at the top of
	ip_input() for safety, like:
		if (m->m_flags & M_EXT)
			m = m_pullup(m, sizeof(struct ip));

itojun