207 	int off = sizeof(struct ip6_hdr), nest;  in ip6_input()  local
558 		if (ip6_hopopts_input(&plen, &rtalert, mp, &off)) {  in ip6_input()
705 		if (m->m_pkthdr.len < off) {  in ip6_input()
756 			pmsg->base.lmsg.u.ms_result = off;  in ip6_input()
761 			nxt = sw6->pr_input(&m, &off, nxt);  in ip6_input()
832 	int off = *offp, hbhlen;  in ip6_hopopts_input()  local
837 	IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1);  in ip6_hopopts_input()
838 	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);  in ip6_hopopts_input()
841 	IP6_EXTHDR_CHECK(m, off, hbhlen, -1);  in ip6_hopopts_input()
842 	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);  in ip6_hopopts_input()
858 	off += hbhlen;  in ip6_hopopts_input()
865 	*offp = off;  in ip6_hopopts_input()
1014 ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off)  in ip6_unknown_opt()  argument
1026 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);  in ip6_unknown_opt()
1036 				    ICMP6_PARAMPROB_OPTION, off);  in ip6_unknown_opt()
1177 		int proto, off, nxt;  in ip6_savecontrol()  local
1188 		off = 0;  in ip6_savecontrol()
1193 			newoff = ip6_nexthdr(m, off, proto, &nxt);  in ip6_savecontrol()
1196 			if (newoff < off) /* invalid, check for safety */  in ip6_savecontrol()
1200 			off = newoff;  in ip6_savecontrol()
1207 		int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr);  in ip6_savecontrol()  local
1238 			if (off + sizeof(*ip6e) > m->m_len)  in ip6_savecontrol()
1240 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off);  in ip6_savecontrol()
1245 			if (off + elen > m->m_len)  in ip6_savecontrol()
1248 			ext = ip6_pullexthdr(m, off, nxt);  in ip6_savecontrol()
1312 			off += elen;  in ip6_savecontrol()
1368 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt)  in ip6_pullexthdr()  argument
1386 	m_copydata(m, off, sizeof(ip6e), &ip6e);  in ip6_pullexthdr()
1402 	m_copydata(m, off, elen, mtod(n, void *));  in ip6_pullexthdr()
1421 ip6_get_prevhdr(struct mbuf *m, int off)  in ip6_get_prevhdr()  argument
1425 	if (off == sizeof(struct ip6_hdr))  in ip6_get_prevhdr()
1433 		while (len < off) {  in ip6_get_prevhdr()
1460 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp)  in ip6_nexthdr()  argument
1469 	if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)  in ip6_nexthdr()
1474 		if (m->m_pkthdr.len < off + sizeof(ip6))  in ip6_nexthdr()
1476 		m_copydata(m, off, sizeof(ip6), &ip6);  in ip6_nexthdr()
1479 		off += sizeof(ip6);  in ip6_nexthdr()
1480 		return off;  in ip6_nexthdr()
1487 		if (m->m_pkthdr.len < off + sizeof(fh))  in ip6_nexthdr()
1489 		m_copydata(m, off, sizeof(fh), &fh);  in ip6_nexthdr()
1495 		off += sizeof(struct ip6_frag);  in ip6_nexthdr()
1496 		return off;  in ip6_nexthdr()
1499 		if (m->m_pkthdr.len < off + sizeof(ip6e))  in ip6_nexthdr()
1501 		m_copydata(m, off, sizeof(ip6e), &ip6e);  in ip6_nexthdr()
1504 		off += (ip6e.ip6e_len + 2) << 2;  in ip6_nexthdr()
1505 		return off;  in ip6_nexthdr()
1510 		if (m->m_pkthdr.len < off + sizeof(ip6e))  in ip6_nexthdr()
1512 		m_copydata(m, off, sizeof(ip6e), &ip6e);  in ip6_nexthdr()
1515 		off += (ip6e.ip6e_len + 1) << 3;  in ip6_nexthdr()
1516 		return off;  in ip6_nexthdr()
1535 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp)  in ip6_lasthdr()  argument
1545 		newoff = ip6_nexthdr(m, off, proto, nxtp);  in ip6_lasthdr()
1547 			return off;  in ip6_lasthdr()
1548 		else if (newoff < off)  in ip6_lasthdr()
1550 		else if (newoff == off)  in ip6_lasthdr()
1553 		off = newoff;  in ip6_lasthdr()