364 	const uint8_t *iefrm_t = iefrm;  in verify_mesh_perr_len()  local
365 	uint8_t ndest = iefrm_t[IEEE80211_MESHPERR_NDEST_OFFSET];  in verify_mesh_perr_len()
376 	iefrm_t += IEEE80211_MESHPERR_NDEST_OFFSET + 1; /* flag is next field */  in verify_mesh_perr_len()
379 		if ((*iefrm_t) & IEEE80211_MESHPERR_FLAGS_AE)  in verify_mesh_perr_len()
380 			iefrm_t += IEEE80211_MESHPERR_DEST_SZ_AE;  in verify_mesh_perr_len()
382 			iefrm_t += IEEE80211_MESHPERR_DEST_SZ;  in verify_mesh_perr_len()
385 	alloc_sz = (iefrm_t - iefrm) - 2; /* action + code */  in verify_mesh_perr_len()
406 	const uint8_t *iefrm_t = iefrm; /* temporary pointer */  in hwmp_recv_action_meshpath()  local
417 			iefrm_t = iefrm;  in hwmp_recv_action_meshpath()
418 			ndest = verify_mesh_preq_len(vap, wh, iefrm_t);  in hwmp_recv_action_meshpath()
429 			preq->preq_ie = *iefrm_t++;  in hwmp_recv_action_meshpath()
430 			preq->preq_len = *iefrm_t++;  in hwmp_recv_action_meshpath()
431 			preq->preq_flags = *iefrm_t++;  in hwmp_recv_action_meshpath()
432 			preq->preq_hopcount = *iefrm_t++;  in hwmp_recv_action_meshpath()
433 			preq->preq_ttl = *iefrm_t++;  in hwmp_recv_action_meshpath()
434 			preq->preq_id = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
435 			IEEE80211_ADDR_COPY(preq->preq_origaddr, iefrm_t);  in hwmp_recv_action_meshpath()
436 			iefrm_t += 6;  in hwmp_recv_action_meshpath()
437 			preq->preq_origseq = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
441 				    preq->preq_orig_ext_addr, iefrm_t);  in hwmp_recv_action_meshpath()
442 				iefrm_t += 6;  in hwmp_recv_action_meshpath()
444 			preq->preq_lifetime = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
445 			preq->preq_metric = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
446 			preq->preq_tcount = *iefrm_t++;  in hwmp_recv_action_meshpath()
449 				preq->preq_targets[i].target_flags = *iefrm_t++;  in hwmp_recv_action_meshpath()
451 				    preq->preq_targets[i].target_addr, iefrm_t);  in hwmp_recv_action_meshpath()
452 				iefrm_t += 6;  in hwmp_recv_action_meshpath()
454 				    le32dec(iefrm_t);  in hwmp_recv_action_meshpath()
455 				iefrm_t += 4;  in hwmp_recv_action_meshpath()
465 			iefrm_t = iefrm;  in hwmp_recv_action_meshpath()
466 			ndest = verify_mesh_prep_len(vap, wh, iefrm_t);  in hwmp_recv_action_meshpath()
476 			prep->prep_ie = *iefrm_t++;  in hwmp_recv_action_meshpath()
477 			prep->prep_len = *iefrm_t++;  in hwmp_recv_action_meshpath()
478 			prep->prep_flags = *iefrm_t++;  in hwmp_recv_action_meshpath()
479 			prep->prep_hopcount = *iefrm_t++;  in hwmp_recv_action_meshpath()
480 			prep->prep_ttl = *iefrm_t++;  in hwmp_recv_action_meshpath()
481 			IEEE80211_ADDR_COPY(prep->prep_targetaddr, iefrm_t);  in hwmp_recv_action_meshpath()
482 			iefrm_t += 6;  in hwmp_recv_action_meshpath()
483 			prep->prep_targetseq = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
487 				    prep->prep_target_ext_addr, iefrm_t);  in hwmp_recv_action_meshpath()
488 				iefrm_t += 6;  in hwmp_recv_action_meshpath()
490 			prep->prep_lifetime = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
491 			prep->prep_metric = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
492 			IEEE80211_ADDR_COPY(prep->prep_origaddr, iefrm_t);  in hwmp_recv_action_meshpath()
493 			iefrm_t += 6;  in hwmp_recv_action_meshpath()
494 			prep->prep_origseq = le32dec(iefrm_t); iefrm_t += 4;  in hwmp_recv_action_meshpath()
505 			iefrm_t = iefrm;  in hwmp_recv_action_meshpath()
506 			ndest = verify_mesh_perr_len(vap, wh, iefrm_t);  in hwmp_recv_action_meshpath()
517 			perr->perr_ie = *iefrm_t++;  in hwmp_recv_action_meshpath()
518 			perr->perr_len = *iefrm_t++;  in hwmp_recv_action_meshpath()
519 			perr->perr_ttl = *iefrm_t++;  in hwmp_recv_action_meshpath()
520 			perr->perr_ndests = *iefrm_t++;  in hwmp_recv_action_meshpath()
523 				perr->perr_dests[i].dest_flags = *iefrm_t++;  in hwmp_recv_action_meshpath()
525 				    perr->perr_dests[i].dest_addr, iefrm_t);  in hwmp_recv_action_meshpath()
526 				iefrm_t += 6;  in hwmp_recv_action_meshpath()
527 				perr->perr_dests[i].dest_seq = le32dec(iefrm_t);  in hwmp_recv_action_meshpath()
528 				iefrm_t += 4;  in hwmp_recv_action_meshpath()
534 					    iefrm_t);  in hwmp_recv_action_meshpath()
535 					iefrm_t += 6;  in hwmp_recv_action_meshpath()
538 				    le16dec(iefrm_t);  in hwmp_recv_action_meshpath()
539 				iefrm_t += 2;  in hwmp_recv_action_meshpath()