git: a5423ccd1c26 - stable/15 - rack_bbr_common: don't use stale pointer after m_pullup()

The branch stable/15 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=a5423ccd1c26e8558ee9af47086b57189875a066

commit a5423ccd1c26e8558ee9af47086b57189875a066
Author:     Jana Smith <thebugfixers@pm.me>
AuthorDate: 2026-06-28 11:04:05 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2026-08-06 09:03:36 +0000

    rack_bbr_common: don't use stale pointer after m_pullup()
    
    Reviewed by:            tuexen
    Differential Revision:  https://reviews.freebsd.org/D57816
    
    (cherry picked from commit be23edc1e4028e32a46e8fe7118de787fd5d79a2)
---
 sys/netinet/tcp_stacks/rack_bbr_common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/tcp_stacks/rack_bbr_common.c b/sys/netinet/tcp_stacks/rack_bbr_common.c
index 4a0a5fc118f6..7303bdf344f3 100644
--- a/sys/netinet/tcp_stacks/rack_bbr_common.c
+++ b/sys/netinet/tcp_stacks/rack_bbr_common.c
@@ -173,7 +173,7 @@ ctf_get_enet_type(struct ifnet *ifp, struct mbuf *m)
 					return (-1);
 				}
 			}
-			ip6 = (struct ip6_hdr *)(eh + 1);
+			ip6 = mtod(m, struct ip6_hdr *);
 			th = (struct tcphdr *)(ip6 + 1);
 			drop_hdrlen = sizeof(*ip6);
 			tlen = ntohs(ip6->ip6_plen);
@@ -205,7 +205,7 @@ ctf_get_enet_type(struct ifnet *ifp, struct mbuf *m)
 					return (-1);
 				}
 			}
-			ip = (struct ip *)(eh + 1);
+			ip = mtod(m, struct ip *);
 			th = (struct tcphdr *)(ip + 1);
 			drop_hdrlen = sizeof(*ip);
 			iptos = ip->ip_tos;