Here's a less confusing diff.
Index: src/sys/dev/usb/if_urndis.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/if_urndis.c,v
retrieving revision 1.29
diff -u -p -r1.29 if_urndis.c
--- src/sys/dev/usb/if_urndis.c 25 Jan 2011 20:03:35 -0000 1.29
+++ src/sys/dev/usb/if_urndis.c 20 Mar 2011 09:29:32 -0000
@@ -801,12 +801,13 @@ urndis_decap(struct urndis_softc *sc, st
DPRINTF(("%s: urndis_decap buffer size left %u\n", DEVNAME(sc),
len));
- if (len < sizeof(*msg)) {
- printf("%s: urndis_decap invalid buffer len %u < "
- "minimum header %u\n",
+ if (len < sizeof(*msg) || len > RNDIS_BUFSZ) {
+ printf("%s: urndis_decap invalid buffer len %u : "
+ "minimum header %u ; maximum buffer size %d\n",
DEVNAME(sc),
len,
- sizeof(*msg));
+ sizeof(*msg),
+ RNDIS_BUFSZ);
return;
}