Bogus KASSERT() in tcp_output()?

[John Baldwin]

Somewhat related fallout to the bug reported on security@ recently, I think 
this KASSERT() in tcp_output() is bogus:


	KASSERT(len + hdrlen + ipoptlen == m_length(m, NULL),
	    ("%s: mbuf chain shorter than expected", __func__));

Specifically, just a few lines earlier in tcp_output() we set the packet 
header length to just 'len + hdrlen':

	/*
	 * Put TCP length in extended header, and then
	 * checksum extended header and data.
	 */
	m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */

Also, the ipoptions are stored in a separate mbuf chain in the in pcb 
(inp_options) that is passed as a separate argument to ip_output().  Given 
that, I would think that m_length() should not reflect ipoptlen since it 
should not include IP options in that chain?

-- 
John Baldwin