strange ip_reass issue on powerpc board, need help

[Rui Zhengxin]

Hi all,
My board is MPC8309SOM, the uec network adapter driver is port from 8313 tsec, it works well.

Now I meet a strange ip_reass issue, it cause a crash.
The condition is send a fragment packet with a non-zero ip_offset value but not set IP_MF flag.
It's very easy to make the fragment packet by ping the target board 65000 bytes after clearing PC's ARP table first. 

I trace the code, after call ip_reass, the mbuf chain may become not correct(ps: not everytime), the last mbuf's m_next pointer not set to NULL.
When the upper layer discard the fragment by calling m_freem, the invalid ext_free function pointer cause crash.
I don't know the reason why the mbuf chain is changed.

If you have MPC8313 or other powerpc board, can you help me verify the issue? Very tks for you help.

Thanks & Best regards,
Rui Zhengxin