It seems as if the m_copymdata() function defined in uipc_mbuf.c has a bug. It uses m_apply to copy data from the source mbuf to the target but in the callback function m_bcopyxxx() the arguments are interpreted in the wrong order. Swapping the 's' and 't' arguments in the declaration of m_bcopyxxx() fixes the problem for me.