off-by-one error in ip_fragment, recently.

I just updated a machine that uses GRE to -CURRENT.  Upon rebooting,
the debugger stopped at the following:

"panic: m_copym, offset > size of mbuf chain"

panic()
m_copym()
ip_fragment()
ip_output()
gre_output()
ip_output()
udp_output()
upd_send()
sosend()
kern_sendit()
sendit()
sendto()
syscall()
xint0x80_syscall()

... now I'm not sure that the error is perfectly technically
off-by-one, but its something similar.

Dave.

-- 
============================================================================
|David Gilbert, Independent Contractor.       | Two things can only be     |
|Mail:       dave_at_daveg.ca                    |  equal if and only if they |
|http://daveg.ca                              |   are precisely opposite.  |
=========================================================GLO================