The bug fix you suggested is close, but incorrect. The sbappendaddr routine free's its input chain if it is sucessful (returns 1) If it is unsucessful, the data chain is not freed. Therefore the call to m_free is not needed, and may cause panic freeing free mbuf.