30 files changed, 527 insertions, 519 deletions

diff --git a/usr.sbin/ppp/acf.c b/usr.sbin/ppp/acf.c
index 821032b3b6e1..9e2b63b18732 100644
--- a/usr.sbin/ppp/acf.c
+++ b/usr.sbin/ppp/acf.c
@@ -62,8 +62,8 @@ acf_LayerPush(struct bundle *b, struct link *l, struct mbuf *bp,
   const u_char cp[2] = { HDLC_ADDR, HDLC_UI };
 
   if (*proto == PROTO_LCP || l->lcp.his_acfcomp == 0) {
-    bp = mbuf_Prepend(bp, cp, 2, 0);
-    mbuf_SetType(bp, MB_ACFOUT);
+    bp = m_prepend(bp, cp, 2, 0);
+    m_settype(bp, MB_ACFOUT);
   }
 
   return bp;
@@ -88,24 +88,24 @@ acf_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp, u_short *proto)
         p->hdlc.lqm.SaveInErrors++;
         p->hdlc.stats.badaddr++;
         log_Printf(LogDEBUG, "acf_LayerPull: addr 0x%02x\n", cp[0]);
-        mbuf_Free(bp);
+        m_freem(bp);
         return NULL;
       }
       if (cp[1] != HDLC_UI) {
         p->hdlc.lqm.SaveInErrors++;
         p->hdlc.stats.badcommand++;
         log_Printf(LogDEBUG, "acf_LayerPull: control 0x%02x\n", cp[1]);
-        mbuf_Free(bp);
+        m_freem(bp);
         return NULL;
       }
-      mbuf_SetType(bp, MB_ACFIN);
+      m_settype(bp, MB_ACFIN);
     } else if (cp[0] == HDLC_ADDR && cp[1] == HDLC_UI) {
       /*
        * We can receive compressed packets, but the peer still sends
        * uncompressed packets (or maybe this is a PROTO_LCP packet) !
        */
       bp = mbuf_Read(bp, cp, 2);
-      mbuf_SetType(bp, MB_ACFIN);
+      m_settype(bp, MB_ACFIN);
     }
   }
 
diff --git a/usr.sbin/ppp/async.c b/usr.sbin/ppp/async.c
index 956413e7b402..6e153a9cadac 100644
--- a/usr.sbin/ppp/async.c
+++ b/usr.sbin/ppp/async.c
@@ -92,8 +92,8 @@ async_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
   struct mbuf *wp;
   int cnt;
 
-  if (!p || mbuf_Length(bp) > HDLCSIZE) {
-    mbuf_Free(bp);
+  if (!p || m_length(bp) > HDLCSIZE) {
+    m_freem(bp);
     return NULL;
   }
 
@@ -103,20 +103,20 @@ async_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
   *cp++ = HDLC_SYN;
   while (wp) {
     sp = MBUF_CTOP(wp);
-    for (cnt = wp->cnt; cnt > 0; cnt--) {
+    for (cnt = wp->m_len; cnt > 0; cnt--) {
       async_Encode(&p->async, &cp, *sp++, *proto);
       if (cp >= ep) {
-	mbuf_Free(bp);
+	m_freem(bp);
 	return NULL;
       }
     }
-    wp = wp->next;
+    wp = wp->m_next;
   }
   *cp++ = HDLC_SYN;
 
   cnt = cp - p->async.xbuff;
-  mbuf_Free(bp);
-  bp = mbuf_Alloc(cnt, MB_ASYNCOUT);
+  m_freem(bp);
+  bp = m_get(cnt, MB_ASYNCOUT);
   memcpy(MBUF_CTOP(bp), p->async.xbuff, cnt);
   log_DumpBp(LogASYNC, "Write", bp);
 
@@ -135,7 +135,7 @@ async_Decode(struct async *async, u_char c)
   case HDLC_SYN:
     async->mode &= ~MODE_HUNT;
     if (async->length) {		/* packet is ready. */
-      bp = mbuf_Alloc(async->length, MB_ASYNCIN);
+      bp = m_get(async->length, MB_ASYNCIN);
       mbuf_Write(bp, async->hbuff, async->length);
       async->length = 0;
       return bp;
@@ -185,12 +185,12 @@ async_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp,
   log_DumpBp(LogASYNC, "Read", bp);
   while (bp) {
     ch = MBUF_CTOP(bp);
-    for (cnt = bp->cnt; cnt; cnt--) {
+    for (cnt = bp->m_len; cnt; cnt--) {
       *last = async_Decode(&p->async, *ch++);
       if (*last != NULL)
-        last = &(*last)->pnext;
+        last = &(*last)->m_nextpkt;
     }
-    bp = mbuf_FreeSeg(bp);
+    bp = m_free(bp);
   }
 
   return nbp;
diff --git a/usr.sbin/ppp/auth.c b/usr.sbin/ppp/auth.c
index 0a8616011fa9..e6020d46a282 100644
--- a/usr.sbin/ppp/auth.c
+++ b/usr.sbin/ppp/auth.c
@@ -327,7 +327,7 @@ auth_ReadHeader(struct authinfo *authp, struct mbuf *bp)
 {
   int len;
 
-  len = mbuf_Length(bp);
+  len = m_length(bp);
   if (len >= sizeof authp->in.hdr) {
     bp = mbuf_Read(bp, (u_char *)&authp->in.hdr, sizeof authp->in.hdr);
     if (len >= ntohs(authp->in.hdr.length))
@@ -341,7 +341,7 @@ auth_ReadHeader(struct authinfo *authp, struct mbuf *bp)
                (int)(sizeof authp->in.hdr), len);
   }
 
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
 
@@ -351,7 +351,7 @@ auth_ReadName(struct authinfo *authp, struct mbuf *bp, int len)
   if (len > sizeof authp->in.name - 1)
     log_Printf(LogWARN, "auth_ReadName: Name too long (%d) !\n", len);
   else {
-    int mlen = mbuf_Length(bp);
+    int mlen = m_length(bp);
 
     if (len > mlen)
       log_Printf(LogWARN, "auth_ReadName: Short packet (%d > %d) !\n",
@@ -364,6 +364,6 @@ auth_ReadName(struct authinfo *authp, struct mbuf *bp, int len)
   }
 
   *authp->in.name = '\0';
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
diff --git a/usr.sbin/ppp/bundle.c b/usr.sbin/ppp/bundle.c
index 9f37815ab98f..c61f388104a8 100644
--- a/usr.sbin/ppp/bundle.c
+++ b/usr.sbin/ppp/bundle.c
@@ -402,12 +402,36 @@ bundle_Down(struct bundle *bundle, int how)
     datalink_Down(dl, how);
 }
 
+static size_t
+bundle_FillQueues(struct bundle *bundle)
+{
+  size_t total;
+
+  if (bundle->ncp.mp.active)
+    total = mp_FillQueues(bundle);
+  else {
+    struct datalink *dl;
+    size_t add;
+
+    for (total = 0, dl = bundle->links; dl; dl = dl->next)
+      if (dl->state == DATALINK_OPEN) {
+        add = link_QueueLen(&dl->physical->link);
+        if (add == 0 && dl->physical->out == NULL)
+          add = ip_PushPacket(&dl->physical->link, bundle);
+        total += add;
+      }
+  }
+
+  return total + ip_QueueLen(&bundle->ncp.ipcp);
+}
+
 static int
 bundle_UpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n)
 {
   struct bundle *bundle = descriptor2bundle(d);
   struct datalink *dl;
-  int result, queued, nlinks;
+  int result, nlinks;
+  size_t queued;
 
   result = 0;
 
@@ -1033,29 +1057,6 @@ bundle2datalink(struct bundle *bundle, const char *name)
 }
 
 int
-bundle_FillQueues(struct bundle *bundle)
-{
-  int total;
-
-  if (bundle->ncp.mp.active)
-    total = mp_FillQueues(bundle);
-  else {
-    struct datalink *dl;
-    int add;
-
-    for (total = 0, dl = bundle->links; dl; dl = dl->next)
-      if (dl->state == DATALINK_OPEN) {
-        add = link_QueueLen(&dl->physical->link);
-        if (add == 0 && dl->physical->out == NULL)
-          add = ip_PushPacket(&dl->physical->link, bundle);
-        total += add;
-      }
-  }
-
-  return total + ip_QueueLen(&bundle->ncp.ipcp);
-}
-
-int
 bundle_ShowLinks(struct cmdargs const *arg)
 {
   struct datalink *dl;
diff --git a/usr.sbin/ppp/bundle.h b/usr.sbin/ppp/bundle.h
index d987c8ae1acb..f52ed0c94743 100644
--- a/usr.sbin/ppp/bundle.h
+++ b/usr.sbin/ppp/bundle.h
@@ -153,7 +153,6 @@ extern void bundle_Down(struct bundle *, int);
 extern void bundle_Open(struct bundle *, const char *, int, int);
 extern void bundle_LinkClosed(struct bundle *, struct datalink *);
 
-extern int bundle_FillQueues(struct bundle *);
 extern int bundle_ShowLinks(struct cmdargs const *);
 extern int bundle_ShowStatus(struct cmdargs const *);
 extern void bundle_StartIdleTimer(struct bundle *);
diff --git a/usr.sbin/ppp/cbcp.c b/usr.sbin/ppp/cbcp.c
index 7de97488ae41..d04e127f7f74 100644
--- a/usr.sbin/ppp/cbcp.c
+++ b/usr.sbin/ppp/cbcp.c
@@ -195,7 +195,7 @@ cbcp_Output(struct cbcp *cbcp, u_char code, struct cbcp_data *data)
   struct cbcp_header *head;
   struct mbuf *bp;
 
-  bp = mbuf_Alloc(sizeof *head + data->length, MB_CBCPOUT);
+  bp = m_get(sizeof *head + data->length, MB_CBCPOUT);
   head = (struct cbcp_header *)MBUF_CTOP(bp);
   head->code = code;
   head->id = cbcp->fsm.id;
@@ -622,29 +622,29 @@ cbcp_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (p == NULL) {
     log_Printf(LogERROR, "cbcp_Input: Not a physical link - dropped\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
-  bp = mbuf_Contiguous(bp);
-  len = mbuf_Length(bp);
+  bp = m_pullup(bp);
+  len = m_length(bp);
   if (len < sizeof(struct cbcp_header)) {
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
   head = (struct cbcp_header *)MBUF_CTOP(bp);
   if (ntohs(head->length) != len) {
     log_Printf(LogWARN, "Corrupt CBCP packet (code %d, length %d not %d)"
                " - ignored\n", head->code, ntohs(head->length), len);
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
-  mbuf_SetType(bp, MB_CBCPIN);
+  m_settype(bp, MB_CBCPIN);
 
   /* XXX check the id */
 
-  bp->offset += sizeof(struct cbcp_header);
-  bp->cnt -= sizeof(struct cbcp_header);
+  bp->m_offset += sizeof(struct cbcp_header);
+  bp->m_len -= sizeof(struct cbcp_header);
   data = (struct cbcp_data *)MBUF_CTOP(bp);
 
   switch (head->code) {
@@ -731,7 +731,7 @@ cbcp_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
       break;
   }
 
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
 
diff --git a/usr.sbin/ppp/ccp.c b/usr.sbin/ppp/ccp.c
index 865756ac3228..a1b5e61e2e72 100644
--- a/usr.sbin/ppp/ccp.c
+++ b/usr.sbin/ppp/ccp.c
@@ -534,14 +534,14 @@ extern struct mbuf *
 ccp_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 {
   /* Got PROTO_CCP from link */
-  mbuf_SetType(bp, MB_CCPIN);
+  m_settype(bp, MB_CCPIN);
   if (bundle_Phase(bundle) == PHASE_NETWORK)
     fsm_Input(&l->ccp.fsm, bp);
   else {
     if (bundle_Phase(bundle) < PHASE_NETWORK)
       log_Printf(LogCCP, "%s: Error: Unexpected CCP in phase %s (ignored)\n",
                  l->ccp.fsm.link->name, bundle_PhaseName(bundle));
-    mbuf_Free(bp);
+    m_freem(bp);
   }
   return NULL;
 }
@@ -584,10 +584,10 @@ ccp_LayerPush(struct bundle *b, struct link *l, struct mbuf *bp,
            (l->ccp.out.state, &l->ccp, l, pri, proto, bp);
     switch (*proto) {
       case PROTO_ICOMPD:
-        mbuf_SetType(bp, MB_ICOMPDOUT);
+        m_settype(bp, MB_ICOMPDOUT);
         break;
       case PROTO_COMPD:
-        mbuf_SetType(bp, MB_COMPDOUT);
+        m_settype(bp, MB_COMPDOUT);
         break;
     }
   }
@@ -616,15 +616,15 @@ ccp_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp, u_short *proto)
                (l->ccp.in.state, &l->ccp, proto, bp);
         switch (*proto) {
           case PROTO_ICOMPD:
-            mbuf_SetType(bp, MB_ICOMPDIN);
+            m_settype(bp, MB_ICOMPDIN);
             break;
           case PROTO_COMPD:
-            mbuf_SetType(bp, MB_COMPDIN);
+            m_settype(bp, MB_COMPDIN);
             break;
         }
         return bp;
       }
-      mbuf_Free(bp);
+      m_freem(bp);
       bp = NULL;
     } else if (PROTO_COMPRESSIBLE(*proto) && l->ccp.in.state != NULL) {
       log_Printf(LogDEBUG, "ccp_LayerPull: Ignore packet (dict only)\n");
diff --git a/usr.sbin/ppp/chap.c b/usr.sbin/ppp/chap.c
index 446e1dc28130..e28c50979670 100644
--- a/usr.sbin/ppp/chap.c
+++ b/usr.sbin/ppp/chap.c
@@ -94,7 +94,7 @@ ChapOutput(struct physical *physical, u_int code, u_int id,
   lh.code = code;
   lh.id = id;
   lh.length = htons(plen);
-  bp = mbuf_Alloc(plen, MB_CHAPOUT);
+  bp = m_get(plen, MB_CHAPOUT);
   memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader));
   if (count)
     memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count);
@@ -546,18 +546,18 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (p == NULL) {
     log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
   if (bundle_Phase(bundle) != PHASE_NETWORK &&
       bundle_Phase(bundle) != PHASE_AUTHENTICATE) {
     log_Printf(LogPHASE, "Unexpected chap input - dropped !\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
-  mbuf_SetType(bp, MB_CHAPIN);
+  m_settype(bp, MB_CHAPIN);
   if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL &&
       ntohs(chap->auth.in.hdr.length) == 0)
     log_Printf(LogWARN, "Chap Input: Truncated header !\n");
@@ -565,7 +565,7 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
     log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n",
                chap->auth.in.hdr.code);
   else {
-    len = mbuf_Length(bp);
+    len = m_length(bp);
     ans = NULL;
 
     if (chap->auth.in.hdr.code != CHAP_CHALLENGE &&
@@ -575,7 +575,7 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
       log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n",
                  chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id,
                  chap->auth.id);
-      mbuf_Free(bp);
+      m_freem(bp);
       return NULL;
     }
     chap->auth.id = chap->auth.in.hdr.id;	/* We respond with this id */
@@ -589,7 +589,7 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
         len -= alen + 1;
         if (len < 0) {
           log_Printf(LogERROR, "Chap Input: Truncated challenge !\n");
-          mbuf_Free(bp);
+          m_freem(bp);
           return NULL;
         }
         *chap->challenge.peer = alen;
@@ -608,12 +608,12 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
         len -= alen + 1;
         if (len < 0) {
           log_Printf(LogERROR, "Chap Input: Truncated response !\n");
-          mbuf_Free(bp);
+          m_freem(bp);
           return NULL;
         }
         if ((ans = malloc(alen + 2)) == NULL) {
           log_Printf(LogERROR, "Chap Input: Out of memory !\n");
-          mbuf_Free(bp);
+          m_freem(bp);
           return NULL;
         }
         *ans = chap->auth.id;
@@ -630,7 +630,7 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
         /* chap->auth.in.name is already set up at CHALLENGE time */
         if ((ans = malloc(len + 1)) == NULL) {
           log_Printf(LogERROR, "Chap Input: Out of memory !\n");
-          mbuf_Free(bp);
+          m_freem(bp);
           return NULL;
         }
         bp = mbuf_Read(bp, ans, len);
@@ -769,6 +769,6 @@ chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
     free(ans);
   }
 
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
diff --git a/usr.sbin/ppp/deflate.c b/usr.sbin/ppp/deflate.c
index 528987be7ae0..196cf2649784 100644
--- a/usr.sbin/ppp/deflate.c
+++ b/usr.sbin/ppp/deflate.c
@@ -75,26 +75,26 @@ DeflateOutput(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
   int olen, ilen, len, res, flush;
   struct mbuf *mo_head, *mo, *mi_head, *mi;
 
-  ilen = mbuf_Length(mp);
+  ilen = m_length(mp);
   log_Printf(LogDEBUG, "DeflateOutput: Proto %02x (%d bytes)\n", *proto, ilen);
   log_DumpBp(LogDEBUG, "DeflateOutput: Compress packet:", mp);
 
   /* Stuff the protocol in front of the input */
-  mi_head = mi = mbuf_Alloc(2, MB_CCPOUT);
-  mi->next = mp;
+  mi_head = mi = m_get(2, MB_CCPOUT);
+  mi->m_next = mp;
   rp = MBUF_CTOP(mi);
   if (*proto < 0x100) {			/* Compress the protocol */
     rp[0] = *proto & 0377;
-    mi->cnt = 1;
+    mi->m_len = 1;
   } else {				/* Don't compress the protocol */
     rp[0] = *proto >> 8;
     rp[1] = *proto & 0377;
-    mi->cnt = 2;
+    mi->m_len = 2;
   }
 
   /* Allocate the initial output mbuf */
-  mo_head = mo = mbuf_Alloc(DEFLATE_CHUNK_LEN, MB_CCPOUT);
-  mo->cnt = 2;
+  mo_head = mo = m_get(DEFLATE_CHUNK_LEN, MB_CCPOUT);
+  mo->m_len = 2;
   wp = MBUF_CTOP(mo);
   *wp++ = state->seqno >> 8;
   *wp++ = state->seqno & 0377;
@@ -105,7 +105,7 @@ DeflateOutput(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
   state->cx.next_out = wp;
   state->cx.avail_out = DEFLATE_CHUNK_LEN - 2;
   state->cx.next_in = MBUF_CTOP(mi);
-  state->cx.avail_in = mi->cnt;
+  state->cx.avail_in = mi->m_len;
   flush = Z_NO_FLUSH;
 
   olen = 0;
@@ -115,8 +115,8 @@ DeflateOutput(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
         break;			/* Done */
       log_Printf(LogWARN, "DeflateOutput: deflate returned %d (%s)\n",
                 res, state->cx.msg ? state->cx.msg : "");
-      mbuf_Free(mo_head);
-      mbuf_FreeSeg(mi_head);
+      m_freem(mo_head);
+      m_free(mi_head);
       state->seqno--;
       return mp;		/* Our dictionary's probably dead now :-( */
     }
@@ -124,25 +124,25 @@ DeflateOutput(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
     if (flush == Z_SYNC_FLUSH && state->cx.avail_out != 0)
       break;
 
-    if (state->cx.avail_in == 0 && mi->next != NULL) {
-      mi = mi->next;
+    if (state->cx.avail_in == 0 && mi->m_next != NULL) {
+      mi = mi->m_next;
       state->cx.next_in = MBUF_CTOP(mi);
-      state->cx.avail_in = mi->cnt;
-      if (mi->next == NULL)
+      state->cx.avail_in = mi->m_len;
+      if (mi->m_next == NULL)
         flush = Z_SYNC_FLUSH;
     }
 
     if (state->cx.avail_out == 0) {
-      mo->next = mbuf_Alloc(DEFLATE_CHUNK_LEN, MB_CCPOUT);
-      olen += (mo->cnt = DEFLATE_CHUNK_LEN);
-      mo = mo->next;
-      mo->cnt = 0;
+      mo->m_next = m_get(DEFLATE_CHUNK_LEN, MB_CCPOUT);
+      olen += (mo->m_len = DEFLATE_CHUNK_LEN);
+      mo = mo->m_next;
+      mo->m_len = 0;
       state->cx.next_out = MBUF_CTOP(mo);
       state->cx.avail_out = DEFLATE_CHUNK_LEN;
     }
   }
 
-  olen += (mo->cnt = DEFLATE_CHUNK_LEN - state->cx.avail_out);
+  olen += (mo->m_len = DEFLATE_CHUNK_LEN - state->cx.avail_out);
   olen -= 4;		/* exclude the trailing EMPTY_BLOCK */
 
   /*
@@ -150,8 +150,8 @@ DeflateOutput(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
    * got bigger, send the original.
    */
   if (olen >= ilen) {
-    mbuf_Free(mo_head);
-    mbuf_FreeSeg(mi_head);
+    m_freem(mo_head);
+    m_free(mi_head);
     log_Printf(LogDEBUG, "DeflateOutput: %d => %d: Uncompressible (0x%04x)\n",
               ilen, olen, *proto);
     ccp->uncompout += ilen;
@@ -159,19 +159,20 @@ DeflateOutput(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
     return mp;
   }
 
-  mbuf_Free(mi_head);
+  m_freem(mi_head);
 
   /*
    * Lose the last four bytes of our output.
    * XXX: We should probably assert that these are the same as the
    *      contents of EMPTY_BLOCK.
    */
-  for (mo = mo_head, len = mo->cnt; len < olen; mo = mo->next, len += mo->cnt)
+  mo = mo_head;
+  for (len = mo->m_len; len < olen; mo = mo->m_next, len += mo->m_len)
     ;
-  mo->cnt -= len - olen;
-  if (mo->next != NULL) {
-    mbuf_Free(mo->next);
-    mo->next = NULL;
+  mo->m_len -= len - olen;
+  if (mo->m_next != NULL) {
+    m_freem(mo->m_next);
+    mo->m_next = NULL;
   }
 
   ccp->uncompout += ilen;
@@ -223,7 +224,7 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
     else {
       log_Printf(LogCCP, "DeflateInput: Seq error: Got %d, expected %d\n",
                 seq, state->seqno);
-      mbuf_Free(mi_head);
+      m_freem(mi_head);
       ccp_SendResetReq(&ccp->fsm);
       return NULL;
     }
@@ -232,7 +233,7 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
   state->uncomp_rec = 0;
 
   /* Allocate an output mbuf */
-  mo_head = mo = mbuf_Alloc(DEFLATE_CHUNK_LEN, MB_CCPIN);
+  mo_head = mo = m_get(DEFLATE_CHUNK_LEN, MB_CCPIN);
 
   /* Our proto starts with 0 if it's compressed */
   wp = MBUF_CTOP(mo);
@@ -244,12 +245,12 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
    * proto field.
    */
   state->cx.next_in = MBUF_CTOP(mi);
-  state->cx.avail_in = mi->cnt;
+  state->cx.avail_in = mi->m_len;
   state->cx.next_out = wp + 1;
   state->cx.avail_out = 1;
-  ilen += mi->cnt;
+  ilen += mi->m_len;
 
-  flush = mi->next ? Z_NO_FLUSH : Z_SYNC_FLUSH;
+  flush = mi->m_next ? Z_NO_FLUSH : Z_SYNC_FLUSH;
   first = 1;
   olen = 0;
 
@@ -259,8 +260,8 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
         break;			/* Done */
       log_Printf(LogCCP, "DeflateInput: inflate returned %d (%s)\n",
                 res, state->cx.msg ? state->cx.msg : "");
-      mbuf_Free(mo_head);
-      mbuf_Free(mi);
+      m_freem(mo_head);
+      m_freem(mi);
       ccp_SendResetReq(&ccp->fsm);
       return NULL;
     }
@@ -268,11 +269,11 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
     if (flush == Z_SYNC_FLUSH && state->cx.avail_out != 0)
       break;
 
-    if (state->cx.avail_in == 0 && mi && (mi = mbuf_FreeSeg(mi)) != NULL) {
+    if (state->cx.avail_in == 0 && mi && (mi = m_free(mi)) != NULL) {
       /* underflow */
       state->cx.next_in = MBUF_CTOP(mi);
-      ilen += (state->cx.avail_in = mi->cnt);
-      if (mi->next == NULL)
+      ilen += (state->cx.avail_in = mi->m_len);
+      if (mi->m_next == NULL)
         flush = Z_SYNC_FLUSH;
     }
 
@@ -288,9 +289,9 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
           state->cx.avail_out = DEFLATE_CHUNK_LEN-2;
         first = 0;
       } else {
-        olen += (mo->cnt = DEFLATE_CHUNK_LEN);
-        mo->next = mbuf_Alloc(DEFLATE_CHUNK_LEN, MB_CCPIN);
-        mo = mo->next;
+        olen += (mo->m_len = DEFLATE_CHUNK_LEN);
+        mo->m_next = m_get(DEFLATE_CHUNK_LEN, MB_CCPIN);
+        mo = mo->m_next;
         state->cx.next_out = MBUF_CTOP(mo);
         state->cx.avail_out = DEFLATE_CHUNK_LEN;
       }
@@ -298,20 +299,20 @@ DeflateInput(void *v, struct ccp *ccp, u_short *proto, struct mbuf *mi)
   }
 
   if (mi != NULL)
-    mbuf_Free(mi);
+    m_freem(mi);
 
   if (first) {
     log_Printf(LogCCP, "DeflateInput: Length error\n");
-    mbuf_Free(mo_head);
+    m_freem(mo_head);
     ccp_SendResetReq(&ccp->fsm);
     return NULL;
   }
 
-  olen += (mo->cnt = DEFLATE_CHUNK_LEN - state->cx.avail_out);
+  olen += (mo->m_len = DEFLATE_CHUNK_LEN - state->cx.avail_out);
 
   *proto = ((u_short)wp[0] << 8) | wp[1];
-  mo_head->offset += 2;
-  mo_head->cnt -= 2;
+  mo_head->m_offset += 2;
+  mo_head->m_len -= 2;
   olen -= 2;
 
   ccp->compin += ilen;
@@ -348,19 +349,19 @@ DeflateDictSetup(void *v, struct ccp *ccp, u_short proto, struct mbuf *mi)
    * Stuff an ``uncompressed data'' block header followed by the
    * protocol in front of the input
    */
-  mi_head = mbuf_Alloc(7, MB_CCPOUT);
-  mi_head->next = mi;
-  len = mbuf_Length(mi);
+  mi_head = m_get(7, MB_CCPOUT);
+  mi_head->m_next = mi;
+  len = m_length(mi);
   mi = mi_head;
   rp = MBUF_CTOP(mi);
   if (proto < 0x100) {			/* Compress the protocol */
     rp[5] = proto & 0377;
-    mi->cnt = 6;
+    mi->m_len = 6;
     len++;
   } else {				/* Don't compress the protocol */
     rp[5] = proto >> 8;
     rp[6] = proto & 0377;
-    mi->cnt = 7;
+    mi->m_len = 7;
     len += 2;
   }
   rp[0] = 0x80;				/* BITS: 100xxxxx */
@@ -370,7 +371,7 @@ DeflateDictSetup(void *v, struct ccp *ccp, u_short proto, struct mbuf *mi)
   rp[4] = (~len) >> 8;
 
   state->cx.next_in = rp;
-  state->cx.avail_in = mi->cnt;
+  state->cx.avail_in = mi->m_len;
   state->cx.next_out = garbage;
   state->cx.avail_out = sizeof garbage;
   flush = Z_NO_FLUSH;
@@ -387,18 +388,18 @@ DeflateDictSetup(void *v, struct ccp *ccp, u_short proto, struct mbuf *mi)
       log_Printf(LogCCP, "DeflateDictSetup: avail_in %d, avail_out %d\n",
                 state->cx.avail_in, state->cx.avail_out);
       ccp_SendResetReq(&ccp->fsm);
-      mbuf_FreeSeg(mi_head);		/* lose our allocated ``head'' buf */
+      m_free(mi_head);		/* lose our allocated ``head'' buf */
       return;
     }
 
     if (flush == Z_SYNC_FLUSH && state->cx.avail_out != 0)
       break;
 
-    if (state->cx.avail_in == 0 && mi && (mi = mi->next) != NULL) {
+    if (state->cx.avail_in == 0 && mi && (mi = mi->m_next) != NULL) {
       /* underflow */
       state->cx.next_in = MBUF_CTOP(mi);
-      state->cx.avail_in = mi->cnt;
-      if (mi->next == NULL)
+      state->cx.avail_in = mi->m_len;
+      if (mi->m_next == NULL)
         flush = Z_SYNC_FLUSH;
     }
 
@@ -427,7 +428,7 @@ DeflateDictSetup(void *v, struct ccp *ccp, u_short proto, struct mbuf *mi)
 
   state->seqno++;
   state->uncomp_rec++;
-  mbuf_FreeSeg(mi_head);		/* lose our allocated ``head'' buf */
+  m_free(mi_head);		/* lose our allocated ``head'' buf */
 }
 
 static const char *
diff --git a/usr.sbin/ppp/fsm.c b/usr.sbin/ppp/fsm.c
index 2e2a2ea4f6ba..8d974450f1dc 100644
--- a/usr.sbin/ppp/fsm.c
+++ b/usr.sbin/ppp/fsm.c
@@ -201,7 +201,7 @@ fsm_Output(struct fsm *fp, u_int code, u_int id, u_char *ptr, int count,
   lh.code = code;
   lh.id = id;
   lh.length = htons(plen);
-  bp = mbuf_Alloc(plen, mtype);
+  bp = m_get(plen, mtype);
   memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader));
   if (count)
     memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count);
@@ -454,12 +454,12 @@ FsmRecvConfigReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   int plen, flen;
   int ackaction = 0;
 
-  plen = mbuf_Length(bp);
+  plen = m_length(bp);
   flen = ntohs(lhp->length) - sizeof *lhp;
   if (plen < flen) {
     log_Printf(LogWARN, "%s: FsmRecvConfigReq: plen (%d) < flen (%d)\n",
 	      fp->link->name, plen, flen);
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   }
 
@@ -471,28 +471,28 @@ FsmRecvConfigReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
        * ccp_SetOpenMode() leaves us in initial if we're disabling
        * & denying everything.
        */
-      bp = mbuf_Prepend(bp, lhp, sizeof *lhp, 2);
+      bp = m_prepend(bp, lhp, sizeof *lhp, 2);
       bp = proto_Prepend(bp, fp->proto, 0, 0);
-      bp = mbuf_Contiguous(bp);
-      lcp_SendProtoRej(&fp->link->lcp, MBUF_CTOP(bp), bp->cnt);
-      mbuf_Free(bp);
+      bp = m_pullup(bp);
+      lcp_SendProtoRej(&fp->link->lcp, MBUF_CTOP(bp), bp->m_len);
+      m_freem(bp);
       return;
     }
     /* Drop through */
   case ST_STARTING:
     log_Printf(fp->LogLevel, "%s: Oops, RCR in %s.\n",
               fp->link->name, State2Nam(fp->state));
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_CLOSED:
     (*fp->fn->SendTerminateAck)(fp, lhp->id);
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_CLOSING:
     log_Printf(fp->LogLevel, "%s: Error: Got ConfigReq while state = %s\n",
               fp->link->name, State2Nam(fp->state));
   case ST_STOPPING:
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_OPENED:
     (*fp->fn->LayerDown)(fp);
@@ -500,7 +500,7 @@ FsmRecvConfigReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     break;
   }
 
-  bp = mbuf_Contiguous(bp);
+  bp = m_pullup(bp);
   dec.ackend = dec.ack;
   dec.nakend = dec.nak;
   dec.rejend = dec.rej;
@@ -570,7 +570,7 @@ FsmRecvConfigReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
       NewState(fp, ST_REQSENT);
     break;
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 
   if (dec.rejend != dec.rej && --fp->more.rejs <= 0) {
     log_Printf(LogPHASE, "%s: Too many %s REJs sent - abandoning negotiation\n",
@@ -624,7 +624,7 @@ FsmRecvConfigAck(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     (*fp->parent->LayerDown)(fp->parent->object, fp);
     break;
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -634,10 +634,10 @@ FsmRecvConfigNak(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   struct fsm_decode dec;
   int plen, flen;
 
-  plen = mbuf_Length(bp);
+  plen = m_length(bp);
   flen = ntohs(lhp->length) - sizeof *lhp;
   if (plen < flen) {
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   }
 
@@ -649,20 +649,20 @@ FsmRecvConfigNak(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   case ST_STARTING:
     log_Printf(fp->LogLevel, "%s: Oops, RCN in %s.\n",
               fp->link->name, State2Nam(fp->state));
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_CLOSED:
   case ST_STOPPED:
     (*fp->fn->SendTerminateAck)(fp, lhp->id);
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_CLOSING:
   case ST_STOPPING:
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   }
 
-  bp = mbuf_Contiguous(bp);
+  bp = m_pullup(bp);
   dec.ackend = dec.ack;
   dec.nakend = dec.nak;
   dec.rejend = dec.rej;
@@ -688,7 +688,7 @@ FsmRecvConfigNak(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     break;
   }
 
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -724,7 +724,7 @@ FsmRecvTermReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     /* A delayed ST_STOPPED is now scheduled */
     break;
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -752,7 +752,7 @@ FsmRecvTermAck(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     (*fp->parent->LayerDown)(fp->parent->object, fp);
     break;
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -762,10 +762,10 @@ FsmRecvConfigRej(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   struct fsm_decode dec;
   int plen, flen;
 
-  plen = mbuf_Length(bp);
+  plen = m_length(bp);
   flen = ntohs(lhp->length) - sizeof *lhp;
   if (plen < flen) {
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   }
 
@@ -777,20 +777,20 @@ FsmRecvConfigRej(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   case ST_STARTING:
     log_Printf(fp->LogLevel, "%s: Oops, RCJ in %s.\n",
               fp->link->name, State2Nam(fp->state));
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_CLOSED:
   case ST_STOPPED:
     (*fp->fn->SendTerminateAck)(fp, lhp->id);
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   case ST_CLOSING:
   case ST_STOPPING:
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   }
 
-  bp = mbuf_Contiguous(bp);
+  bp = m_pullup(bp);
   dec.ackend = dec.ack;
   dec.nakend = dec.nak;
   dec.rejend = dec.rej;
@@ -815,13 +815,13 @@ FsmRecvConfigRej(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     NewState(fp, ST_REQSENT);
     break;
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
 FsmRecvCodeRej(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
 {
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -830,8 +830,8 @@ FsmRecvProtoRej(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   struct physical *p = link2physical(fp->link);
   u_short proto;
 
-  if (mbuf_Length(bp) < 2) {
-    mbuf_Free(bp);
+  if (m_length(bp) < 2) {
+    m_freem(bp);
     return;
   }
   bp = mbuf_Read(bp, &proto, 2);
@@ -883,7 +883,7 @@ FsmRecvProtoRej(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     }
     break;
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -893,8 +893,8 @@ FsmRecvEchoReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   u_char *cp;
   u_int32_t magic;
 
-  bp = mbuf_Contiguous(bp);
-  mbuf_SetType(bp, MB_ECHOIN);
+  bp = m_pullup(bp);
+  m_settype(bp, MB_ECHOIN);
 
   if (lcp && ntohs(lhp->length) - sizeof *lhp >= 4) {
     cp = MBUF_CTOP(bp);
@@ -911,7 +911,7 @@ FsmRecvEchoReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
                  ntohs(lhp->length) - sizeof *lhp, MB_ECHOOUT);
     }
   }
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -920,25 +920,25 @@ FsmRecvEchoRep(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   if (fsm2lcp(fp))
     bp = lqr_RecvEcho(fp, bp);
 
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
 FsmRecvDiscReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
 {
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
 FsmRecvIdent(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
 {
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
 FsmRecvTimeRemain(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
 {
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
@@ -952,14 +952,14 @@ FsmRecvResetReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
    */
   link_SequenceQueue(fp->link);
   fsm_Output(fp, CODE_RESETACK, lhp->id, NULL, 0, MB_CCPOUT);
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 static void
 FsmRecvResetAck(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
 {
   (*fp->fn->RecvResetAck)(fp, lhp->id);
-  mbuf_Free(bp);
+  m_freem(bp);
 }
 
 void
@@ -969,9 +969,9 @@ fsm_Input(struct fsm *fp, struct mbuf *bp)
   struct fsmheader lh;
   const struct fsmcodedesc *codep;
 
-  len = mbuf_Length(bp);
+  len = m_length(bp);
   if (len < sizeof(struct fsmheader)) {
-    mbuf_Free(bp);
+    m_freem(bp);
     return;
   }
   bp = mbuf_Read(bp, &lh, sizeof lh);
@@ -988,10 +988,10 @@ fsm_Input(struct fsm *fp, struct mbuf *bp)
      */
     static u_char id;
 
-    bp = mbuf_Prepend(bp, &lh, sizeof lh, 0);
-    bp = mbuf_Contiguous(bp);
-    fsm_Output(fp, CODE_CODEREJ, id++, MBUF_CTOP(bp), bp->cnt, MB_UNKNOWN);
-    mbuf_Free(bp);
+    bp = m_prepend(bp, &lh, sizeof lh, 0);
+    bp = m_pullup(bp);
+    fsm_Output(fp, CODE_CODEREJ, id++, MBUF_CTOP(bp), bp->m_len, MB_UNKNOWN);
+    m_freem(bp);
     return;
   }
 
diff --git a/usr.sbin/ppp/hdlc.c b/usr.sbin/ppp/hdlc.c
index 3f5d6b9d6ba8..af39c30e4228 100644
--- a/usr.sbin/ppp/hdlc.c
+++ b/usr.sbin/ppp/hdlc.c
@@ -115,15 +115,15 @@ HdlcFcsBuf(u_short fcs, struct mbuf *m)
   int len;
   u_char *pos, *end;
 
-  len = mbuf_Length(m);
+  len = m_length(m);
   pos = MBUF_CTOP(m);
-  end = pos + m->cnt;
+  end = pos + m->m_len;
   while (len--) {
     fcs = (fcs >> 8) ^ fcstab[(fcs ^ *pos++) & 0xff];
     if (pos == end && len) {
-      m = m->next;
+      m = m->m_next;
       pos = MBUF_CTOP(m);
-      end = pos + m->cnt;
+      end = pos + m->m_len;
     }
   }
   return (fcs);
@@ -143,19 +143,19 @@ hdlc_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
   u_char *cp;
   u_short fcs;
 
-  mbuf_SetType(bp, MB_HDLCOUT);
+  m_settype(bp, MB_HDLCOUT);
   fcs = HdlcFcsBuf(INITFCS, bp);
   fcs = ~fcs;
 
-  for (last = bp; last->next; last = last->next)
+  for (last = bp; last->m_next; last = last->m_next)
     ;
 
-  if (last->size - last->offset - last->cnt >= 2) {
-    cp = MBUF_CTOP(last) + last->cnt;
-    last->cnt += 2;
+  if (last->m_size - last->m_offset - last->m_len >= 2) {
+    cp = MBUF_CTOP(last) + last->m_len;
+    last->m_len += 2;
   } else {
-    struct mbuf *tail = mbuf_Alloc(2, MB_HDLCOUT);
-    last->next = tail;
+    struct mbuf *tail = m_get(2, MB_HDLCOUT);
+    last->m_next = tail;
     cp = MBUF_CTOP(tail);
   }
 
@@ -306,31 +306,31 @@ hdlc_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp,
     return bp;
   }
 
-  log_DumpBp(LogHDLC, "hdlc_Input:", bp);
+  log_DumpBp(LogHDLC, "hdlc_LayerPull:", bp);
 
-  fcs = hdlc_Fcs(MBUF_CTOP(bp), bp->cnt);
+  fcs = hdlc_Fcs(MBUF_CTOP(bp), bp->m_len);
 
-  log_Printf(LogDEBUG, "%s: hdlc_Input: fcs = %04x (%s)\n",
+  log_Printf(LogDEBUG, "%s: hdlc_LayerPull: fcs = %04x (%s)\n",
              p->link.name, fcs, (fcs == GOODFCS) ? "good" : "BAD!");
 
   if (fcs != GOODFCS) {
     p->hdlc.lqm.SaveInErrors++;
     p->hdlc.stats.badfcs++;
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
-  p->hdlc.lqm.SaveInOctets += bp->cnt + 1;
+  p->hdlc.lqm.SaveInOctets += bp->m_len + 1;
   p->hdlc.lqm.SaveInPackets++;
 
-  len = mbuf_Length(bp);
+  len = m_length(bp);
   if (len < 4) {			/* rfc1662 section 4.3 */
-    mbuf_Free(bp);
+    m_freem(bp);
     bp = NULL;
   }
 
-  bp = mbuf_Truncate(bp, len - 2);	/* discard the FCS */
-  mbuf_SetType(bp, MB_HDLCIN);
+  bp = m_adj(bp, -2);			/* discard the FCS */
+  m_settype(bp, MB_HDLCIN);
 
   return bp;
 }
diff --git a/usr.sbin/ppp/ip.c b/usr.sbin/ppp/ip.c
index 2e5f00c21efa..793103341d11 100644
--- a/usr.sbin/ppp/ip.c
+++ b/usr.sbin/ppp/ip.c
@@ -301,10 +301,10 @@ IcmpError(struct ip *pip, int code)
   struct mbuf *bp;
 
   if (pip->ip_p != IPPROTO_ICMP) {
-    bp = mbuf_Alloc(cnt, MB_IPIN);
-    memcpy(MBUF_CTOP(bp), ptr, cnt);
+    bp = m_get(m_len, MB_IPIN);
+    memcpy(MBUF_CTOP(bp), ptr, m_len);
     vj_SendFrame(bp);
-    ipcp_AddOutOctets(cnt);
+    ipcp_AddOutOctets(m_len);
   }
 }
 #endif
@@ -493,17 +493,17 @@ ip_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (bundle->ncp.ipcp.fsm.state != ST_OPENED) {
     log_Printf(LogWARN, "ip_Input: IPCP not open - packet dropped\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
-  mbuf_SetType(bp, MB_IPIN);
+  m_settype(bp, MB_IPIN);
   tun_fill_header(tun, AF_INET);
-  nb = mbuf_Length(bp);
+  nb = m_length(bp);
   if (nb > sizeof tun.data) {
     log_Printf(LogWARN, "ip_Input: %s: Packet too large (got %d, max %d)\n",
                l->name, nb, (int)(sizeof tun.data));
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
   mbuf_Read(bp, tun.data, nb);
@@ -541,14 +541,14 @@ ip_Enqueue(struct ipcp *ipcp, int pri, char *ptr, int count)
     /*
      * We allocate an extra 6 bytes, four at the front and two at the end.
      * This is an optimisation so that we need to do less work in
-     * mbuf_Prepend() in acf_LayerPush() and proto_LayerPush() and
+     * m_prepend() in acf_LayerPush() and proto_LayerPush() and
      * appending in hdlc_LayerPush().
      */
-    bp = mbuf_Alloc(count + 6, MB_IPOUT);
-    bp->offset += 4;
-    bp->cnt -= 6;
+    bp = m_get(count + 6, MB_IPOUT);
+    bp->m_offset += 4;
+    bp->m_len -= 6;
     memcpy(MBUF_CTOP(bp), ptr, count);
-    mbuf_Enqueue(ipcp->Queue + pri, bp);
+    m_enqueue(ipcp->Queue + pri, bp);
   }
 }
 
@@ -559,17 +559,18 @@ ip_DeleteQueue(struct ipcp *ipcp)
 
   for (queue = ipcp->Queue; queue < ipcp->Queue + IPCP_QUEUES(ipcp); queue++)
     while (queue->top)
-      mbuf_Free(mbuf_Dequeue(queue));
+      m_freem(m_dequeue(queue));
 }
 
-int
+size_t
 ip_QueueLen(struct ipcp *ipcp)
 {
   struct mqueue *queue;
-  int result = 0;
+  size_t result;
 
+  result = 0;
   for (queue = ipcp->Queue; queue < ipcp->Queue + IPCP_QUEUES(ipcp); queue++)
-    result += queue->qlen;
+    result += queue->len;
 
   return result;
 }
@@ -581,7 +582,7 @@ ip_PushPacket(struct link *l, struct bundle *bundle)
   struct mqueue *queue;
   struct mbuf *bp;
   struct ip *pip;
-  int cnt;
+  int m_len;
 
   if (ipcp->fsm.state != ST_OPENED)
     return 0;
@@ -589,13 +590,13 @@ ip_PushPacket(struct link *l, struct bundle *bundle)
   queue = ipcp->Queue + IPCP_QUEUES(ipcp) - 1;
   do {
     if (queue->top) {
-      bp = mbuf_Contiguous(mbuf_Dequeue(queue));
-      cnt = mbuf_Length(bp);
+      bp = m_pullup(m_dequeue(queue));
+      m_len = m_length(bp);
       pip = (struct ip *)MBUF_CTOP(bp);
       if (!FilterCheck(pip, &bundle->filter.alive))
         bundle_StartIdleTimer(bundle);
       link_PushPacket(l, bp, bundle, 0, PROTO_IP);
-      ipcp_AddOutOctets(ipcp, cnt);
+      ipcp_AddOutOctets(ipcp, m_len);
       return 1;
     }
   } while (queue-- != ipcp->Queue);
diff --git a/usr.sbin/ppp/ip.h b/usr.sbin/ppp/ip.h
index 21e4a36b3791..4c493cc4314f 100644
--- a/usr.sbin/ppp/ip.h
+++ b/usr.sbin/ppp/ip.h
@@ -31,4 +31,4 @@ extern int  PacketCheck(struct bundle *, char *, int, struct filter *);
 extern void ip_Enqueue(struct ipcp *, int, char *, int);
 extern struct mbuf *ip_Input(struct bundle *, struct link *, struct mbuf *);
 extern void ip_DeleteQueue(struct ipcp *);
-extern int  ip_QueueLen(struct ipcp *);
+extern size_t ip_QueueLen(struct ipcp *);
diff --git a/usr.sbin/ppp/ipcp.c b/usr.sbin/ppp/ipcp.c
index 3efb315d8364..ba2473fec197 100644
--- a/usr.sbin/ppp/ipcp.c
+++ b/usr.sbin/ppp/ipcp.c
@@ -1284,14 +1284,14 @@ extern struct mbuf *
 ipcp_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 {
   /* Got PROTO_IPCP from link */
-  mbuf_SetType(bp, MB_IPCPIN);
+  m_settype(bp, MB_IPCPIN);
   if (bundle_Phase(bundle) == PHASE_NETWORK)
     fsm_Input(&bundle->ncp.ipcp.fsm, bp);
   else {
     if (bundle_Phase(bundle) < PHASE_NETWORK)
       log_Printf(LogIPCP, "%s: Error: Unexpected IPCP in phase %s (ignored)\n",
                  l->name, bundle_PhaseName(bundle));
-    mbuf_Free(bp);
+    m_freem(bp);
   }
   return NULL;
 }
diff --git a/usr.sbin/ppp/lcp.c b/usr.sbin/ppp/lcp.c
index 062f8ba03f59..0c2bc081d24c 100644
--- a/usr.sbin/ppp/lcp.c
+++ b/usr.sbin/ppp/lcp.c
@@ -1154,7 +1154,7 @@ extern struct mbuf *
 lcp_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 {
   /* Got PROTO_LCP from link */
-  mbuf_SetType(bp, MB_LCPIN);
+  m_settype(bp, MB_LCPIN);
   fsm_Input(&l->lcp.fsm, bp);
   return NULL;
 }
diff --git a/usr.sbin/ppp/link.c b/usr.sbin/ppp/link.c
index a96fb9a53aca..e52c31b6e7fb 100644
--- a/usr.sbin/ppp/link.c
+++ b/usr.sbin/ppp/link.c
@@ -88,8 +88,8 @@ link_SequenceQueue(struct link *l)
 
   highest = LINK_HIGHQ(l);
   for (queue = l->Queue; queue < highest; queue++)
-    while (queue->qlen)
-      mbuf_Enqueue(highest, mbuf_Dequeue(queue));
+    while (queue->len)
+      m_enqueue(highest, m_dequeue(queue));
 }
 
 void
@@ -100,33 +100,35 @@ link_DeleteQueue(struct link *l)
   highest = LINK_HIGHQ(l);
   for (queue = l->Queue; queue <= highest; queue++)
     while (queue->top)
-      mbuf_Free(mbuf_Dequeue(queue));
+      m_freem(m_dequeue(queue));
 }
 
-int
+size_t
 link_QueueLen(struct link *l)
 {
-  int i, len;
+  int i;
+  size_t len;
 
   for (i = 0, len = 0; i < LINK_QUEUES(l); i++)
-    len += l->Queue[i].qlen;
+    len += l->Queue[i].len;
 
   return len;
 }
 
-int
+size_t
 link_QueueBytes(struct link *l)
 {
-  int i, len, bytes;
+  int i;
+  size_t len, bytes;
   struct mbuf *m;
 
   bytes = 0;
   for (i = 0, len = 0; i < LINK_QUEUES(l); i++) {
-    len = l->Queue[i].qlen;
+    len = l->Queue[i].len;
     m = l->Queue[i].top;
     while (len--) {
-      bytes += mbuf_Length(m);
-      m = m->pnext;
+      bytes += m_length(m);
+      m = m->m_nextpkt;
     }
   }
 
@@ -140,10 +142,11 @@ link_Dequeue(struct link *l)
   struct mbuf *bp;
 
   for (bp = NULL, pri = LINK_QUEUES(l) - 1; pri >= 0; pri--)
-    if (l->Queue[pri].qlen) {
-      bp = mbuf_Dequeue(l->Queue + pri);
+    if (l->Queue[pri].len) {
+      bp = m_dequeue(l->Queue + pri);
       log_Printf(LogDEBUG, "link_Dequeue: Dequeued from queue %d,"
-                " containing %d more packets\n", pri, l->Queue[pri].qlen);
+                " containing %lu more packets\n", pri,
+                (u_long)l->Queue[pri].len);
       break;
     }
 
@@ -222,9 +225,9 @@ link_PushPacket(struct link *l, struct mbuf *bp, struct bundle *b, int pri,
       bp = (*l->layer[layer - 1]->push)(b, l, bp, pri, &proto);
 
   if (bp) {
-    link_AddOutOctets(l, mbuf_Length(bp));
+    link_AddOutOctets(l, m_length(bp));
     log_Printf(LogDEBUG, "link_PushPacket: Transmit proto 0x%04x\n", proto);
-    mbuf_Enqueue(l->Queue + pri, mbuf_Contiguous(bp));
+    m_enqueue(l->Queue + pri, m_pullup(bp));
   }
 }
 
@@ -239,7 +242,7 @@ link_PullPacket(struct link *l, char *buf, size_t len, struct bundle *b)
    * When we ``pull'' a packet from the link, it gets processed by the
    * ``pull'' function in each layer starting at the bottom.
    * Each ``pull'' may produce multiple packets, chained together using
-   * bp->pnext.
+   * bp->m_nextpkt.
    * Each packet that results from each pull has to be pulled through
    * all of the higher layers before the next resulting packet is pulled
    * through anything; this ensures that packets that depend on the
@@ -250,7 +253,7 @@ link_PullPacket(struct link *l, char *buf, size_t len, struct bundle *b)
   link_AddInOctets(l, len);
 
   memset(lbp, '\0', sizeof lbp);
-  lbp[0] = mbuf_Alloc(len, MB_UNKNOWN);
+  lbp[0] = m_get(len, MB_UNKNOWN);
   memcpy(MBUF_CTOP(lbp[0]), buf, len);
   lproto[0] = 0;
   layer = 0;
@@ -261,8 +264,8 @@ link_PullPacket(struct link *l, char *buf, size_t len, struct bundle *b)
       continue;
     }
     bp = lbp[layer];
-    lbp[layer] = bp->pnext;
-    bp->pnext = NULL;
+    lbp[layer] = bp->m_nextpkt;
+    bp->m_nextpkt = NULL;
     proto = lproto[layer];
 
     if (l->layer[layer]->pull != NULL)
@@ -271,8 +274,8 @@ link_PullPacket(struct link *l, char *buf, size_t len, struct bundle *b)
     if (layer == l->nlayers - 1) {
       /* We've just done the top layer, despatch the packet(s) */
       while (bp) {
-        next = bp->pnext;
-        bp->pnext = NULL;
+        next = bp->m_nextpkt;
+        bp->m_nextpkt = NULL;
         log_Printf(LogDEBUG, "link_PullPacket: Despatch proto 0x%04x\n", proto);
         Despatch(b, l, bp, proto);
         bp = next;
@@ -336,13 +339,13 @@ Despatch(struct bundle *bundle, struct link *l, struct mbuf *bp, u_short proto)
     log_Printf(LogPHASE, "%s protocol 0x%04x (%s)\n",
                f == DSIZE ? "Unknown" : "Unexpected", proto,
                hdlc_Protocol2Nam(proto));
-    bp = mbuf_Contiguous(proto_Prepend(bp, proto, 0, 0));
-    lcp_SendProtoRej(&l->lcp, MBUF_CTOP(bp), bp->cnt);
+    bp = m_pullup(proto_Prepend(bp, proto, 0, 0));
+    lcp_SendProtoRej(&l->lcp, MBUF_CTOP(bp), bp->m_len);
     if (p) {
       p->hdlc.lqm.SaveInDiscards++;
       p->hdlc.stats.unknownproto++;
     }
-    mbuf_Free(bp);
+    m_freem(bp);
   }
 }
 
diff --git a/usr.sbin/ppp/link.h b/usr.sbin/ppp/link.h
index e277630b33f1..36dfd503a689 100644
--- a/usr.sbin/ppp/link.h
+++ b/usr.sbin/ppp/link.h
@@ -62,8 +62,8 @@ extern void link_AddOutOctets(struct link *, int);
 
 extern void link_SequenceQueue(struct link *);
 extern void link_DeleteQueue(struct link *);
-extern int link_QueueLen(struct link *);
-extern int link_QueueBytes(struct link *);
+extern size_t link_QueueLen(struct link *);
+extern size_t link_QueueBytes(struct link *);
 extern struct mbuf *link_Dequeue(struct link *);
 
 extern void link_PushPacket(struct link *, struct mbuf *, struct bundle *,
diff --git a/usr.sbin/ppp/log.c b/usr.sbin/ppp/log.c
index 7c45d17f7521..2756a32879d1 100644
--- a/usr.sbin/ppp/log.c
+++ b/usr.sbin/ppp/log.c
@@ -351,7 +351,7 @@ log_DumpBp(int lev, const char *hdr, const struct mbuf *bp)
     b = buf;
     c = b + 50;
     do {
-      f = bp->cnt;
+      f = bp->m_len;
       ptr = CONST_MBUF_CTOP(bp);
       while (f--) {
 	sprintf(b, " %02x", (int) *ptr);
@@ -366,7 +366,7 @@ log_DumpBp(int lev, const char *hdr, const struct mbuf *bp)
           c = b + 50;
         }
       }
-    } while ((bp = bp->next) != NULL);
+    } while ((bp = bp->m_next) != NULL);
 
     if (b > buf) {
       memset(b, ' ', 50 - (b - buf));
diff --git a/usr.sbin/ppp/lqr.c b/usr.sbin/ppp/lqr.c
index b47e3fc388b2..3e9f0f672f52 100644
--- a/usr.sbin/ppp/lqr.c
+++ b/usr.sbin/ppp/lqr.c
@@ -85,7 +85,7 @@ lqr_RecvEcho(struct fsm *fp, struct mbuf *bp)
   struct lcp *lcp = fsm2lcp(fp);
   struct echolqr lqr;
 
-  if (mbuf_Length(bp) == sizeof lqr) {
+  if (m_length(bp) == sizeof lqr) {
     bp = mbuf_Read(bp, &lqr, sizeof lqr);
     lqr.magic = ntohl(lqr.magic);
     lqr.signature = ntohl(lqr.signature);
@@ -112,7 +112,7 @@ lqr_RecvEcho(struct fsm *fp, struct mbuf *bp)
                 (u_long)lqr.signature, (u_long)SIGNATURE);
   } else
     log_Printf(LogWARN, "lqr_RecvEcho: Got packet size %d, expecting %ld !\n",
-              mbuf_Length(bp), (long)sizeof(struct echolqr));
+              m_length(bp), (long)sizeof(struct echolqr));
   return bp;
 }
 
@@ -136,9 +136,9 @@ SendLqrData(struct lcp *lcp)
 
   extra = proto_WrapperOctets(lcp, PROTO_LQR) +
           acf_WrapperOctets(lcp, PROTO_LQR);
-  bp = mbuf_Alloc(sizeof(struct lqrdata) + extra, MB_LQROUT);
-  bp->cnt -= extra;
-  bp->offset += extra;
+  bp = m_get(sizeof(struct lqrdata) + extra, MB_LQROUT);
+  bp->m_len -= extra;
+  bp->m_offset += extra;
   link_PushPacket(lcp->fsm.link, bp, lcp->fsm.bundle,
                   LINK_QUEUES(lcp->fsm.link) - 1, PROTO_LQR);
 }
@@ -191,24 +191,24 @@ lqr_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (p == NULL) {
     log_Printf(LogERROR, "lqr_Input: Not a physical link - dropped\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
   p->hdlc.lqm.lqr.SaveInLQRs++;
 
-  len = mbuf_Length(bp);
+  len = m_length(bp);
   if (len != sizeof(struct lqrdata))
     log_Printf(LogWARN, "lqr_Input: Got packet size %d, expecting %ld !\n",
               len, (long)sizeof(struct lqrdata));
   else if (!IsAccepted(l->lcp.cfg.lqr) && !(p->hdlc.lqm.method & LQM_LQR)) {
-    bp = mbuf_Contiguous(proto_Prepend(bp, PROTO_LQR, 0, 0));
-    lcp_SendProtoRej(lcp, MBUF_CTOP(bp), bp->cnt);
+    bp = m_pullup(proto_Prepend(bp, PROTO_LQR, 0, 0));
+    lcp_SendProtoRej(lcp, MBUF_CTOP(bp), bp->m_len);
   } else {
     struct lqrdata *lqr;
     u_int32_t lastLQR;
 
-    bp = mbuf_Contiguous(bp);
+    bp = m_pullup(bp);
     lqr = (struct lqrdata *)MBUF_CTOP(bp);
     if (ntohl(lqr->MagicNumber) != lcp->his_magic)
       log_Printf(LogWARN, "lqr_Input: magic 0x%08lx is wrong,"
@@ -239,7 +239,7 @@ lqr_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
         SendLqrData(lcp);
     }
   }
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
 
@@ -357,7 +357,7 @@ lqr_LayerPush(struct bundle *b, struct link *l, struct mbuf *bp,
 
   if (!p) {
     /* Oops - can't happen :-] */
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
@@ -379,8 +379,8 @@ lqr_LayerPush(struct bundle *b, struct link *l, struct mbuf *bp,
    * don't do LQR without these layers.
    */
 
-  bp = mbuf_Contiguous(bp);
-  len = mbuf_Length(bp);
+  bp = m_pullup(bp);
+  len = m_length(bp);
 
   if (!physical_IsSync(p))
     p->hdlc.lqm.OutOctets += hdlc_WrapperOctets(&l->lcp, *proto);
@@ -428,7 +428,7 @@ lqr_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp, u_short *proto)
    * to lqr_Input()
    */
   if (*proto == PROTO_LQR)
-    mbuf_SetType(bp, MB_LQRIN);
+    m_settype(bp, MB_LQRIN);
   return bp;
 }
 
diff --git a/usr.sbin/ppp/mbuf.c b/usr.sbin/ppp/mbuf.c
index c2520fd2c16b..4382421e0729 100644
--- a/usr.sbin/ppp/mbuf.c
+++ b/usr.sbin/ppp/mbuf.c
@@ -38,24 +38,25 @@
 
 static struct memmap {
   struct mbuf *queue;
-  int fragments, octets;
+  size_t fragments;
+  size_t octets;
 } MemMap[MB_MAX + 1];
 
 static int totalalloced;
 static unsigned long long mbuf_Mallocs, mbuf_Frees;
 
 int
-mbuf_Length(struct mbuf *bp)
+m_length(struct mbuf *bp)
 {
   int len;
 
-  for (len = 0; bp; bp = bp->next)
-    len += bp->cnt;
+  for (len = 0; bp; bp = bp->m_next)
+    len += bp->m_len;
   return len;
 }
 
 struct mbuf *
-mbuf_Alloc(int cnt, int type)
+m_get(size_t m_len, int type)
 {
   struct mbuf *bp;
 
@@ -63,7 +64,7 @@ mbuf_Alloc(int cnt, int type)
     log_Printf(LogERROR, "Bad mbuf type %d\n", type);
     type = MB_UNKNOWN;
   }
-  bp = malloc(sizeof(struct mbuf) + cnt);
+  bp = malloc(sizeof *bp + m_len);
   if (bp == NULL) {
     log_Printf(LogALERT, "failed to allocate memory: %ld\n",
                (long)sizeof(struct mbuf));
@@ -72,23 +73,23 @@ mbuf_Alloc(int cnt, int type)
   mbuf_Mallocs++;
   memset(bp, '\0', sizeof(struct mbuf));
   MemMap[type].fragments++;
-  MemMap[type].octets += cnt;
-  totalalloced += cnt;
-  bp->size = bp->cnt = cnt;
-  bp->type = type;
+  MemMap[type].octets += m_len;
+  totalalloced += m_len;
+  bp->m_size = bp->m_len = m_len;
+  bp->m_type = type;
   return bp;
 }
 
 struct mbuf *
-mbuf_FreeSeg(struct mbuf *bp)
+m_free(struct mbuf *bp)
 {
   struct mbuf *nbp;
 
   if (bp) {
-    nbp = bp->next;
-    MemMap[bp->type].fragments--;
-    MemMap[bp->type].octets -= bp->size;
-    totalalloced -= bp->size;
+    nbp = bp->m_next;
+    MemMap[bp->m_type].fragments--;
+    MemMap[bp->m_type].octets -= bp->m_size;
+    totalalloced -= bp->m_size;
     free(bp);
     mbuf_Frees++;
     bp = nbp;
@@ -98,10 +99,10 @@ mbuf_FreeSeg(struct mbuf *bp)
 }
 
 void
-mbuf_Free(struct mbuf *bp)
+m_freem(struct mbuf *bp)
 {
   while (bp)
-    bp = mbuf_FreeSeg(bp);
+    bp = m_free(bp);
 }
 
 struct mbuf *
@@ -111,23 +112,23 @@ mbuf_Read(struct mbuf *bp, void *v, size_t len)
   u_char *ptr = v;
 
   while (bp && len > 0) {
-    if (len > bp->cnt)
-      nb = bp->cnt;
+    if (len > bp->m_len)
+      nb = bp->m_len;
     else
       nb = len;
     if (nb) {
       memcpy(ptr, MBUF_CTOP(bp), nb);
       ptr += nb;
-      bp->cnt -= nb;
+      bp->m_len -= nb;
       len -= nb;
-      bp->offset += nb;
+      bp->m_offset += nb;
     }
-    if (bp->cnt == 0)
-      bp = mbuf_FreeSeg(bp);
+    if (bp->m_len == 0)
+      bp = m_free(bp);
   }
 
-  while (bp && bp->cnt == 0)
-    bp = mbuf_FreeSeg(bp);
+  while (bp && bp->m_len == 0)
+    bp = m_free(bp);
 
   return bp;
 }
@@ -139,80 +140,91 @@ mbuf_View(struct mbuf *bp, void *v, size_t len)
   u_char *ptr = v;
 
   while (bp && l > 0) {
-    if (l > bp->cnt)
-      nb = bp->cnt;
+    if (l > bp->m_len)
+      nb = bp->m_len;
     else
       nb = l;
     memcpy(ptr, MBUF_CTOP(bp), nb);
     ptr += nb;
     l -= nb;
-    bp = bp->next;
+    bp = bp->m_next;
   }
 
   return len - l;
 }
 
 struct mbuf *
-mbuf_Prepend(struct mbuf *bp, const void *ptr, size_t len, size_t extra)
+m_prepend(struct mbuf *bp, const void *ptr, size_t len, size_t extra)
 {
   struct mbuf *head;
 
-  if (bp && bp->offset) {
-    if (bp->offset >= len) {
-      bp->offset -= len;
-      bp->cnt += len;
+  if (bp && bp->m_offset) {
+    if (bp->m_offset >= len) {
+      bp->m_offset -= len;
+      bp->m_len += len;
       memcpy(MBUF_CTOP(bp), ptr, len);
       return bp;
     }
-    len -= bp->offset;
-    memcpy(bp + 1, (const char *)ptr + len, bp->offset);
-    bp->cnt += bp->offset;
-    bp->offset = 0;
+    len -= bp->m_offset;
+    memcpy(bp + 1, (const char *)ptr + len, bp->m_offset);
+    bp->m_len += bp->m_offset;
+    bp->m_offset = 0;
   }
 
-  head = mbuf_Alloc(len + extra, bp ? bp->type : MB_UNKNOWN);
-  head->offset = extra;
-  head->cnt -= extra;
+  head = m_get(len + extra, bp ? bp->m_type : MB_UNKNOWN);
+  head->m_offset = extra;
+  head->m_len -= extra;
   memcpy(MBUF_CTOP(head), ptr, len);
-  head->next = bp;
+  head->m_next = bp;
 
   return head;
 }
 
 struct mbuf *
-mbuf_Truncate(struct mbuf *bp, size_t n)
+m_adj(struct mbuf *bp, ssize_t n)
 {
-  if (n == 0) {
-    mbuf_Free(bp);
-    return NULL;
-  }
-
-  for (; bp; bp = bp->next, n -= bp->cnt)
-    if (n < bp->cnt) {
-      bp->cnt = n;
-      mbuf_Free(bp->next);
-      bp->next = NULL;
-      break;
+  if (n > 0) {
+    while (bp) {
+      if (n < bp->m_len) {
+        bp->m_len = n;
+        bp->m_offset += n;
+        return bp;
+      }
+      n -= bp->m_len;
+      bp = m_free(bp);
     }
+  } else {
+    if ((n = m_length(bp) + n) <= 0) {
+      m_freem(bp);
+      return NULL;
+    }
+    for (; bp; bp = bp->m_next, n -= bp->m_len)
+      if (n < bp->m_len) {
+        bp->m_len = n;
+        m_freem(bp->m_next);
+        bp->m_next = NULL;
+        break;
+      }
+  }
 
   return bp;
 }
 
 void
-mbuf_Write(struct mbuf *bp, const void *ptr, size_t cnt)
+mbuf_Write(struct mbuf *bp, const void *ptr, size_t m_len)
 {
   int plen;
   int nb;
 
-  plen = mbuf_Length(bp);
-  if (plen < cnt)
-    cnt = plen;
+  plen = m_length(bp);
+  if (plen < m_len)
+    m_len = plen;
 
-  while (cnt > 0) {
-    nb = (cnt < bp->cnt) ? cnt : bp->cnt;
+  while (m_len > 0) {
+    nb = (m_len < bp->m_len) ? m_len : bp->m_len;
     memcpy(MBUF_CTOP(bp), ptr, nb);
-    cnt -= bp->cnt;
-    bp = bp->next;
+    m_len -= bp->m_len;
+    bp = bp->m_next;
   }
 }
 
@@ -232,13 +244,16 @@ mbuf_Show(struct cmdargs const *arg)
 
   prompt_Printf(arg->prompt, "Fragments (octets) in use:\n");
   for (i = 0; i < MB_MAX; i += 2)
-    prompt_Printf(arg->prompt, "%10.10s: %04d (%06d)\t%10.10s: %04d (%06d)\n",
-	    mbuftype[i], MemMap[i].fragments, MemMap[i].octets,
-            mbuftype[i+1], MemMap[i+1].fragments, MemMap[i+1].octets);
+    prompt_Printf(arg->prompt, "%10.10s: %04lu (%06lu)\t"
+                  "%10.10s: %04lu (%06lu)\n",
+	          mbuftype[i], (u_long)MemMap[i].fragments,
+                  (u_long)MemMap[i].octets, mbuftype[i+1],
+                  (u_long)MemMap[i+1].fragments, (u_long)MemMap[i+1].octets);
 
   if (i == MB_MAX)
-    prompt_Printf(arg->prompt, "%10.10s: %04d (%06d)\n",
-                  mbuftype[i], MemMap[i].fragments, MemMap[i].octets);
+    prompt_Printf(arg->prompt, "%10.10s: %04lu (%06lu)\n",
+                  mbuftype[i], (u_long)MemMap[i].fragments,
+                  (u_long)MemMap[i].octets);
 
   prompt_Printf(arg->prompt, "Mallocs: %llu,   Frees: %llu\n",
                 mbuf_Mallocs, mbuf_Frees);
@@ -247,62 +262,63 @@ mbuf_Show(struct cmdargs const *arg)
 }
 
 struct mbuf *
-mbuf_Dequeue(struct mqueue *q)
+m_dequeue(struct mqueue *q)
 {
   struct mbuf *bp;
   
-  log_Printf(LogDEBUG, "mbuf_Dequeue: queue len = %d\n", q->qlen);
+  log_Printf(LogDEBUG, "m_dequeue: queue len = %lu\n", (u_long)q->len);
   bp = q->top;
   if (bp) {
-    q->top = q->top->pnext;
-    q->qlen--;
+    q->top = q->top->m_nextpkt;
+    q->len--;
     if (q->top == NULL) {
       q->last = q->top;
-      if (q->qlen)
-	log_Printf(LogERROR, "mbuf_Dequeue: Not zero (%d)!!!\n", q->qlen);
+      if (q->len)
+	log_Printf(LogERROR, "m_dequeue: Not zero (%lu)!!!\n",
+                   (u_long)q->len);
     }
-    bp->pnext = NULL;
+    bp->m_nextpkt = NULL;
   }
 
   return bp;
 }
 
 void
-mbuf_Enqueue(struct mqueue *queue, struct mbuf *bp)
+m_enqueue(struct mqueue *queue, struct mbuf *bp)
 {
   if (bp != NULL) {
     if (queue->last) {
-      queue->last->pnext = bp;
+      queue->last->m_nextpkt = bp;
       queue->last = bp;
     } else
       queue->last = queue->top = bp;
-    queue->qlen++;
-    log_Printf(LogDEBUG, "mbuf_Enqueue: len = %d\n", queue->qlen);
+    queue->len++;
+    log_Printf(LogDEBUG, "m_enqueue: len = %d\n", queue->len);
   }
 }
 
 struct mbuf *
-mbuf_Contiguous(struct mbuf *bp)
+m_pullup(struct mbuf *bp)
 {
   /* Put it all in one contigous (aligned) mbuf */
 
   if (bp != NULL) {
-    if (bp->next != NULL) {
+    if (bp->m_next != NULL) {
       struct mbuf *nbp;
       u_char *cp;
 
-      nbp = mbuf_Alloc(mbuf_Length(bp), bp->type);
+      nbp = m_get(m_length(bp), bp->m_type);
 
-      for (cp = MBUF_CTOP(nbp); bp; bp = mbuf_FreeSeg(bp)) {
-        memcpy(cp, MBUF_CTOP(bp), bp->cnt);
-        cp += bp->cnt;
+      for (cp = MBUF_CTOP(nbp); bp; bp = m_free(bp)) {
+        memcpy(cp, MBUF_CTOP(bp), bp->m_len);
+        cp += bp->m_len;
       }
       bp = nbp;
     }
 #ifndef __i386__	/* Do any other archs not care about alignment ? */
-    else if ((bp->offset & (sizeof(long) - 1)) != 0) {
-      bcopy(MBUF_CTOP(bp), bp + 1, bp->cnt);
-      bp->offset = 0;
+    else if ((bp->m_offset & (sizeof(long) - 1)) != 0) {
+      bcopy(MBUF_CTOP(bp), bp + 1, bp->m_len);
+      bp->m_offset = 0;
     }
 #endif
   }
@@ -311,14 +327,14 @@ mbuf_Contiguous(struct mbuf *bp)
 }
 
 void
-mbuf_SetType(struct mbuf *bp, int type)
+m_settype(struct mbuf *bp, int type)
 {
-  for (; bp; bp = bp->next)
-    if (type != bp->type) {
-      MemMap[bp->type].fragments--;
-      MemMap[bp->type].octets -= bp->size;
-      bp->type = type;
+  for (; bp; bp = bp->m_next)
+    if (type != bp->m_type) {
+      MemMap[bp->m_type].fragments--;
+      MemMap[bp->m_type].octets -= bp->m_size;
+      bp->m_type = type;
       MemMap[type].fragments++;
-      MemMap[type].octets += bp->size;
+      MemMap[type].octets += bp->m_size;
     }
 }
diff --git a/usr.sbin/ppp/mbuf.h b/usr.sbin/ppp/mbuf.h
index 7b0669b3d441..64e37216a27f 100644
--- a/usr.sbin/ppp/mbuf.h
+++ b/usr.sbin/ppp/mbuf.h
@@ -21,26 +21,26 @@
  */
 
 struct mbuf {
-  short size;			/* size allocated (excluding header) */
-  short offset;			/* offset from header end to start position */
-  short cnt;			/* available byte count in buffer */
-  short type;			/* MB_* below */
-  struct mbuf *next;		/* link to next mbuf */
-  struct mbuf *pnext;		/* link to next packet */
+  size_t m_size;		/* size allocated (excluding header) */
+  short m_offset;		/* offset from header end to start position */
+  size_t m_len;			/* available byte count in buffer */
+  short m_type;			/* MB_* below */
+  struct mbuf *m_next;		/* link to next mbuf */
+  struct mbuf *m_nextpkt;	/* link to next packet */
   /* buffer space is malloc()d directly after the header */
 };
 
 struct mqueue {
   struct mbuf *top;
   struct mbuf *last;
-  int qlen;
+  size_t len;
 };
 
 #define MBUF_CTOP(bp) \
-	((bp) ? (u_char *)((bp)+1) + (bp)->offset : NULL)
+	((bp) ? (u_char *)((bp)+1) + (bp)->m_offset : NULL)
 
 #define CONST_MBUF_CTOP(bp) \
-	((bp) ? (const u_char *)((bp)+1) + (bp)->offset : NULL)
+	((bp) ? (const u_char *)((bp)+1) + (bp)->m_offset : NULL)
 
 #define MB_IPIN		0
 #define MB_IPOUT	1
@@ -85,17 +85,19 @@ struct mqueue {
 
 struct cmdargs;
 
-extern int mbuf_Length(struct mbuf *);
-extern struct mbuf *mbuf_Alloc(int, int);
-extern struct mbuf *mbuf_FreeSeg(struct mbuf *);
-extern void mbuf_Free(struct mbuf *);
+extern int m_length(struct mbuf *);
+extern struct mbuf *m_get(size_t, int);
+extern struct mbuf *m_free(struct mbuf *);
+extern void m_freem(struct mbuf *);
 extern void mbuf_Write(struct mbuf *, const void *, size_t);
 extern struct mbuf *mbuf_Read(struct mbuf *, void *, size_t);
 extern size_t mbuf_View(struct mbuf *, void *, size_t);
-extern struct mbuf *mbuf_Prepend(struct mbuf *, const void *, size_t, size_t);
-extern struct mbuf *mbuf_Truncate(struct mbuf *, size_t);
+extern struct mbuf *m_prepend(struct mbuf *, const void *, size_t, size_t);
+extern struct mbuf *m_adj(struct mbuf *, ssize_t);
+extern struct mbuf *m_pullup(struct mbuf *);
+extern void m_settype(struct mbuf *, int);
+
 extern int mbuf_Show(struct cmdargs const *);
-extern void mbuf_Enqueue(struct mqueue *, struct mbuf *);
-extern struct mbuf *mbuf_Dequeue(struct mqueue *);
-extern struct mbuf *mbuf_Contiguous(struct mbuf *);
-extern void mbuf_SetType(struct mbuf *, int);
+
+extern void m_enqueue(struct mqueue *, struct mbuf *);
+extern struct mbuf *m_dequeue(struct mqueue *);
diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c
index 516255ccab6f..1829194a5fa7 100644
--- a/usr.sbin/ppp/mp.c
+++ b/usr.sbin/ppp/mp.c
@@ -386,8 +386,8 @@ mp_Down(struct mp *mp)
 
     /* Received fragments go in the bit-bucket */
     while (mp->inbufs) {
-      next = mp->inbufs->pnext;
-      mbuf_Free(mp->inbufs);
+      next = mp->inbufs->m_nextpkt;
+      m_freem(mp->inbufs);
       mp->inbufs = next;
     }
 
@@ -417,7 +417,7 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
    */
 
   if (m && mp_ReadHeader(mp, m, &mh) == 0) {
-    mbuf_Free(m);
+    m_freem(m);
     return;
   }
 
@@ -461,10 +461,10 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
     if (m && isbefore(mp->local_is12bit, mh.seq, h.seq)) {
       /* Our received fragment fits in before this one, so link it in */
       if (last)
-        last->pnext = m;
+        last->m_nextpkt = m;
       else
         mp->inbufs = m;
-      m->pnext = q;
+      m->m_nextpkt = q;
       q = m;
       h = mh;
       m = NULL;
@@ -479,8 +479,8 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
         /* Zap all older fragments */
         while (mp->inbufs != q) {
           log_Printf(LogDEBUG, "Drop frag\n");
-          next = mp->inbufs->pnext;
-          mbuf_Free(mp->inbufs);
+          next = mp->inbufs->m_nextpkt;
+          m_freem(mp->inbufs);
           mp->inbufs = next;
         }
 
@@ -496,9 +496,9 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
             h.seq--;  /* We're gonna look for fragment with h.seq+1 */
             break;
           }
-          next = mp->inbufs->pnext;
+          next = mp->inbufs->m_nextpkt;
           log_Printf(LogDEBUG, "Drop frag %u\n", h.seq);
-          mbuf_Free(mp->inbufs);
+          m_freem(mp->inbufs);
           mp->inbufs = next;
         } while (mp->inbufs && (isbefore(mp->local_is12bit, mp->seq.min_in,
                                          h.seq) || h.end));
@@ -525,17 +525,17 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
 
       do {
         *frag = mp->inbufs;
-        mp->inbufs = mp->inbufs->pnext;
+        mp->inbufs = mp->inbufs->m_nextpkt;
         len = mp_ReadHeader(mp, *frag, &h);
         if (first == -1)
           first = h.seq;
-        (*frag)->offset += len;
-        (*frag)->cnt -= len;
-        (*frag)->pnext = NULL;
+        (*frag)->m_offset += len;
+        (*frag)->m_len -= len;
+        (*frag)->m_nextpkt = NULL;
         if (frag == &q && !h.begin) {
           log_Printf(LogWARN, "Oops - MP frag %lu should have a begin flag\n",
                     (u_long)h.seq);
-          mbuf_Free(q);
+          m_freem(q);
           q = NULL;
         } else if (frag != &q && h.begin) {
           log_Printf(LogWARN, "Oops - MP frag %lu should have an end flag\n",
@@ -544,25 +544,25 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
            * Stuff our fragment back at the front of the queue and zap
            * our half-assembed packet.
            */
-          (*frag)->pnext = mp->inbufs;
+          (*frag)->m_nextpkt = mp->inbufs;
           mp->inbufs = *frag;
           *frag = NULL;
-          mbuf_Free(q);
+          m_freem(q);
           q = NULL;
           frag = &q;
           h.end = 0;	/* just in case it's a whole packet */
         } else
           do
-            frag = &(*frag)->next;
+            frag = &(*frag)->m_next;
           while (*frag != NULL);
       } while (!h.end);
 
       if (q) {
-        q = mbuf_Contiguous(q);
+        q = m_pullup(q);
         log_Printf(LogDEBUG, "MP: Reassembled frags %ld-%lu, length %d\n",
-                   first, (u_long)h.seq, mbuf_Length(q));
-        link_PullPacket(&mp->link, MBUF_CTOP(q), q->cnt, mp->bundle);
-        mbuf_Free(q);
+                   first, (u_long)h.seq, m_length(q));
+        link_PullPacket(&mp->link, MBUF_CTOP(q), q->m_len, mp->bundle);
+        m_freem(q);
       }
 
       mp->seq.next_in = seq = inc_seq(mp->local_is12bit, h.seq);
@@ -572,24 +572,24 @@ mp_Assemble(struct mp *mp, struct mbuf *m, struct physical *p)
       /* Look for the next fragment */
       seq = inc_seq(mp->local_is12bit, seq);
       last = q;
-      q = q->pnext;
+      q = q->m_nextpkt;
     }
   }
 
   if (m) {
     /* We still have to find a home for our new fragment */
     last = NULL;
-    for (q = mp->inbufs; q; last = q, q = q->pnext) {
+    for (q = mp->inbufs; q; last = q, q = q->m_nextpkt) {
       mp_ReadHeader(mp, q, &h);
       if (isbefore(mp->local_is12bit, mh.seq, h.seq))
         break;
     }
     /* Our received fragment fits in here */
     if (last)
-      last->pnext = m;
+      last->m_nextpkt = m;
     else
       mp->inbufs = m;
-    m->pnext = q;
+    m->m_nextpkt = q;
   }
 }
 
@@ -604,9 +604,9 @@ mp_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (p == NULL) {
     log_Printf(LogWARN, "DecodePacket: Can't do MP inside MP !\n");
-    mbuf_Free(bp);
+    m_freem(bp);
   } else {
-    mbuf_SetType(bp, MB_MPIN);
+    m_settype(bp, MB_MPIN);
     mp_Assemble(&bundle->ncp.mp, bp, p);
   }
 
@@ -617,30 +617,29 @@ static void
 mp_Output(struct mp *mp, struct bundle *bundle, struct link *l,
           struct mbuf *m, u_int32_t begin, u_int32_t end)
 {
-  struct mbuf *mo;
+  char prepend[4];
 
   /* Stuff an MP header on the front of our packet and send it */
-  mo = mbuf_Alloc(4, MB_MPOUT);
-  mo->next = m;
+
   if (mp->peer_is12bit) {
     u_int16_t val;
 
     val = (begin << 15) | (end << 14) | (u_int16_t)mp->out.seq;
-    ua_htons(&val, MBUF_CTOP(mo));
-    mo->cnt = 2;
+    ua_htons(&val, prepend);
+    m = m_prepend(m, prepend, 2, 0);
   } else {
     u_int32_t val;
 
     val = (begin << 31) | (end << 30) | (u_int32_t)mp->out.seq;
-    ua_htonl(&val, MBUF_CTOP(mo));
-    mo->cnt = 4;
+    ua_htonl(&val, prepend);
+    m = m_prepend(m, prepend, 4, 0);
   }
   if (log_IsKept(LogDEBUG))
     log_Printf(LogDEBUG, "MP[frag %d]: Send %d bytes on link `%s'\n",
-               mp->out.seq, mbuf_Length(mo), l->name);
+               mp->out.seq, m_length(m), l->name);
   mp->out.seq = inc_seq(mp->peer_is12bit, mp->out.seq);
 
-  link_PushPacket(l, mo, bundle, LINK_QUEUES(l) - 1, PROTO_MP);
+  link_PushPacket(l, m, bundle, LINK_QUEUES(l) - 1, PROTO_MP);
 }
 
 int
@@ -648,7 +647,8 @@ mp_FillQueues(struct bundle *bundle)
 {
   struct mp *mp = &bundle->ncp.mp;
   struct datalink *dl, *fdl;
-  int total, add, len, thislink, nlinks;
+  size_t total, add, len;
+  int thislink, nlinks;
   u_int32_t begin, end;
   struct mbuf *m, *mo;
 
@@ -696,7 +696,7 @@ mp_FillQueues(struct bundle *bundle)
       break;
 
     m = link_Dequeue(&mp->link);
-    len = mbuf_Length(m);
+    len = m_length(m);
     begin = 1;
     end = 0;
 
@@ -706,12 +706,12 @@ mp_FillQueues(struct bundle *bundle)
         if (len <= dl->physical->link.lcp.his_mru) {
           mo = m;
           end = 1;
-          mbuf_SetType(mo, MB_MPOUT);
+          m_settype(mo, MB_MPOUT);
         } else {
           /* It's > his_mru, chop the packet (`m') into bits */
-          mo = mbuf_Alloc(dl->physical->link.lcp.his_mru, MB_MPOUT);
-          len -= mo->cnt;
-          m = mbuf_Read(m, MBUF_CTOP(mo), mo->cnt);
+          mo = m_get(dl->physical->link.lcp.his_mru, MB_MPOUT);
+          len -= mo->m_len;
+          m = mbuf_Read(m, MBUF_CTOP(mo), mo->m_len);
         }
         mp_Output(mp, bundle, &dl->physical->link, mo, begin, end);
         begin = 0;
@@ -767,7 +767,7 @@ mp_ShowStatus(struct cmdargs const *arg)
     lm = NULL;
     prompt_Printf(arg->prompt, "Socket:         %s\n",
                   mp->server.socket.sun_path);
-    for (m = mp->inbufs; m; m = m->pnext) {
+    for (m = mp->inbufs; m; m = m->m_nextpkt) {
       bufs++;
       lm = m;
     }
diff --git a/usr.sbin/ppp/nat_cmd.c b/usr.sbin/ppp/nat_cmd.c
index ebf13e7ca99a..bc789292650a 100644
--- a/usr.sbin/ppp/nat_cmd.c
+++ b/usr.sbin/ppp/nat_cmd.c
@@ -336,22 +336,6 @@ nat_Pptp(struct cmdargs const *arg)
 }
 
 static struct mbuf *
-nat_PadMbuf(struct mbuf *bp, int type)
-{
-  struct mbuf **last;
-  int len;
-
-  mbuf_SetType(bp, type);
-  for (last = &bp, len = 0; *last != NULL; last = &(*last)->next)
-    len += (*last)->cnt;
-
-  len = MAX_MRU - len;
-  *last = mbuf_Alloc(len, type);
-
-  return bp;
-}
-
-static struct mbuf *
 nat_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
                 int pri, u_short *proto)
 {
@@ -359,9 +343,9 @@ nat_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
     return bp;
 
   log_Printf(LogDEBUG, "nat_LayerPush: PROTO_IP -> PROTO_IP\n");
-  bp = mbuf_Contiguous(nat_PadMbuf(bp, MB_NATOUT));
-  PacketAliasOut(MBUF_CTOP(bp), bp->cnt);
-  bp->cnt = ntohs(((struct ip *)MBUF_CTOP(bp))->ip_len);
+  m_settype(bp, MB_NATOUT);
+  bp = m_pullup(bp);
+  PacketAliasOut(MBUF_CTOP(bp), bp->m_len);
 
   return bp;
 }
@@ -379,7 +363,8 @@ nat_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
     return bp;
 
   log_Printf(LogDEBUG, "nat_LayerPull: PROTO_IP -> PROTO_IP\n");
-  bp = mbuf_Contiguous(nat_PadMbuf(bp, MB_NATIN));
+  m_settype(bp, MB_NATIN);
+  bp = m_pullup(bp);
   pip = (struct ip *)MBUF_CTOP(bp);
   piip = (struct ip *)((char *)pip + (pip->ip_hl << 2));
 
@@ -387,13 +372,13 @@ nat_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
       (pip->ip_p == IPPROTO_IPIP && IN_CLASSD(ntohl(piip->ip_dst.s_addr))))
     return bp;
 
-  ret = PacketAliasIn(MBUF_CTOP(bp), bp->cnt);
+  ret = PacketAliasIn(MBUF_CTOP(bp), bp->m_len);
 
-  bp->cnt = ntohs(pip->ip_len);
-  if (bp->cnt > MAX_MRU) {
+  bp->m_len = ntohs(pip->ip_len);
+  if (bp->m_len > MAX_MRU) {
     log_Printf(LogWARN, "nat_LayerPull: Problem with IP header length (%d)\n",
-               bp->cnt);
-    mbuf_Free(bp);
+               bp->m_len);
+    m_freem(bp);
     return NULL;
   }
 
@@ -403,26 +388,26 @@ nat_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
 
     case PKT_ALIAS_UNRESOLVED_FRAGMENT:
       /* Save the data for later */
-      fptr = malloc(bp->cnt);
-      bp = mbuf_Read(bp, fptr, bp->cnt);
+      fptr = malloc(bp->m_len);
+      bp = mbuf_Read(bp, fptr, bp->m_len);
       PacketAliasSaveFragment(fptr);
       break;
 
     case PKT_ALIAS_FOUND_HEADER_FRAGMENT:
       /* Fetch all the saved fragments and chain them on the end of `bp' */
-      last = &bp->pnext;
+      last = &bp->m_nextpkt;
       while ((fptr = PacketAliasGetFragment(MBUF_CTOP(bp))) != NULL) {
 	PacketAliasFragmentIn(MBUF_CTOP(bp), fptr);
         len = ntohs(((struct ip *)fptr)->ip_len);
-        *last = mbuf_Alloc(len, MB_NATIN);
+        *last = m_get(len, MB_NATIN);
         memcpy(MBUF_CTOP(*last), fptr, len);
         free(fptr);
-        last = &(*last)->pnext;
+        last = &(*last)->m_nextpkt;
       }
       break;
 
     default:
-      mbuf_Free(bp);
+      m_freem(bp);
       bp = NULL;
       break;
   }
diff --git a/usr.sbin/ppp/pap.c b/usr.sbin/ppp/pap.c
index e857d0a8ec3f..a25962ca1cd3 100644
--- a/usr.sbin/ppp/pap.c
+++ b/usr.sbin/ppp/pap.c
@@ -86,7 +86,7 @@ pap_Req(struct authinfo *authp)
   lh.code = PAP_REQUEST;
   lh.id = authp->id;
   lh.length = htons(plen + sizeof(struct fsmheader));
-  bp = mbuf_Alloc(plen + sizeof(struct fsmheader), MB_PAPOUT);
+  bp = m_get(plen + sizeof(struct fsmheader), MB_PAPOUT);
   memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader));
   cp = MBUF_CTOP(bp) + sizeof(struct fsmheader);
   *cp++ = namelen;
@@ -111,7 +111,7 @@ SendPapCode(struct authinfo *authp, int code, const char *message)
   mlen = strlen(message);
   plen = mlen + 1;
   lh.length = htons(plen + sizeof(struct fsmheader));
-  bp = mbuf_Alloc(plen + sizeof(struct fsmheader), MB_PAPOUT);
+  bp = m_get(plen + sizeof(struct fsmheader), MB_PAPOUT);
   memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader));
   cp = MBUF_CTOP(bp) + sizeof(struct fsmheader);
   /*
@@ -168,14 +168,14 @@ pap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (p == NULL) {
     log_Printf(LogERROR, "pap_Input: Not a physical link - dropped\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
   if (bundle_Phase(bundle) != PHASE_NETWORK &&
       bundle_Phase(bundle) != PHASE_AUTHENTICATE) {
     log_Printf(LogPHASE, "Unexpected pap input - dropped !\n");
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
@@ -187,7 +187,7 @@ pap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
 
   if (authp->in.hdr.code == 0 || authp->in.hdr.code > MAXPAPCODE) {
     log_Printf(LogPHASE, "Pap Input: %d: Bad PAP code !\n", authp->in.hdr.code);
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
@@ -196,10 +196,10 @@ pap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
     /* Wrong conversation dude ! */
     log_Printf(LogPHASE, "Pap Input: %s dropped (got id %d, not %d)\n",
                papcodes[authp->in.hdr.code], authp->in.hdr.id, authp->id);
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
-  mbuf_SetType(bp, MB_PAPIN);
+  m_settype(bp, MB_PAPIN);
   authp->id = authp->in.hdr.id;		/* We respond with this id */
 
   if (bp) {
@@ -210,9 +210,9 @@ pap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
        * nlen (a one-byte length).  Show the rest of the ack packet
        * instead.  This isn't really part of the protocol.....
        */
-      bp = mbuf_Contiguous(bp);
+      bp = m_pullup(bp);
       txt = MBUF_CTOP(bp);
-      txtlen = mbuf_Length(bp);
+      txtlen = m_length(bp);
     } else {
       bp = auth_ReadName(authp, bp, nlen);
       txt = authp->in.name;
@@ -233,7 +233,7 @@ pap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
         break;
       }
       bp = mbuf_Read(bp, &klen, 1);
-      if (mbuf_Length(bp) < klen) {
+      if (m_length(bp) < klen) {
         log_Printf(LogERROR, "Pap Input: Truncated key !\n");
         break;
       }
@@ -278,6 +278,6 @@ pap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
       break;
   }
 
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
diff --git a/usr.sbin/ppp/physical.c b/usr.sbin/ppp/physical.c
index 61e22a492ed2..92d47f8e0d42 100644
--- a/usr.sbin/ppp/physical.c
+++ b/usr.sbin/ppp/physical.c
@@ -384,14 +384,14 @@ physical_DescriptorWrite(struct descriptor *d, struct bundle *bundle,
     p->out = link_Dequeue(&p->link);
 
   if (p->out) {
-    nw = physical_Write(p, MBUF_CTOP(p->out), p->out->cnt);
+    nw = physical_Write(p, MBUF_CTOP(p->out), p->out->m_len);
     log_Printf(LogDEBUG, "%s: DescriptorWrite: wrote %d(%d) to %d\n",
-               p->link.name, nw, p->out->cnt, p->fd);
+               p->link.name, nw, p->out->m_len, p->fd);
     if (nw > 0) {
-      p->out->cnt -= nw;
-      p->out->offset += nw;
-      if (p->out->cnt == 0)
-	p->out = mbuf_FreeSeg(p->out);
+      p->out->m_len -= nw;
+      p->out->m_offset += nw;
+      if (p->out->m_len == 0)
+	p->out = m_free(p->out);
       result = 1;
     } else if (nw < 0) {
       if (errno != EAGAIN) {
@@ -437,8 +437,8 @@ physical_ShowStatus(struct cmdargs const *arg)
       prompt_Printf(arg->prompt, " Physical outq:   %d\n", n);
 #endif
 
-  prompt_Printf(arg->prompt, " Queued Packets:  %d\n",
-                link_QueueLen(&p->link));
+  prompt_Printf(arg->prompt, " Queued Packets:  %lu\n",
+                (u_long)link_QueueLen(&p->link));
   prompt_Printf(arg->prompt, " Phone Number:    %s\n", arg->cx->phone.chosen);
 
   prompt_Printf(arg->prompt, "\nDefaults:\n");
@@ -903,7 +903,7 @@ void
 physical_DeleteQueue(struct physical *p)
 {
   if (p->out) {
-    mbuf_Free(p->out);
+    m_freem(p->out);
     p->out = NULL;
   }
   link_DeleteQueue(&p->link);
diff --git a/usr.sbin/ppp/pred.c b/usr.sbin/ppp/pred.c
index de831eec2e16..d21a28f81d44 100644
--- a/usr.sbin/ppp/pred.c
+++ b/usr.sbin/ppp/pred.c
@@ -179,8 +179,8 @@ Pred1Output(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
   u_char bufp[MAX_MTU + 2];
   u_short fcs;
 
-  orglen = mbuf_Length(bp) + 2;	/* add count of proto */
-  mwp = mbuf_Alloc((orglen + 2) / 8 * 9 + 12, MB_CCPOUT);
+  orglen = m_length(bp) + 2;	/* add count of proto */
+  mwp = m_get((orglen + 2) / 8 * 9 + 12, MB_CCPOUT);
   hp = wp = MBUF_CTOP(mwp);
   cp = bufp;
   *wp++ = *cp++ = orglen >> 8;
@@ -206,7 +206,7 @@ Pred1Output(void *v, struct ccp *ccp, struct link *l, int pri, u_short *proto,
 
   *wp++ = fcs & 0377;
   *wp++ = fcs >> 8;
-  mwp->cnt = wp - MBUF_CTOP(mwp);
+  mwp->m_len = wp - MBUF_CTOP(mwp);
   *proto = ccp_Proto(ccp);
   return mwp;
 }
@@ -221,9 +221,9 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
   u_char *bufp;
   u_short fcs;
 
-  wp = mbuf_Alloc(MAX_MRU + 2, MB_CCPIN);
+  wp = m_get(MAX_MRU + 2, MB_CCPIN);
   cp = MBUF_CTOP(bp);
-  olen = mbuf_Length(bp);
+  olen = m_length(bp);
   pp = bufp = MBUF_CTOP(wp);
   *pp++ = *cp & 0177;
   len = *cp++ << 8;
@@ -237,8 +237,8 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
     if (len != len1) {		/* Error is detected. Send reset request */
       log_Printf(LogCCP, "Pred1: Length error (got %d, not %d)\n", len1, len);
       fsm_Reopen(&ccp->fsm);
-      mbuf_Free(bp);
-      mbuf_Free(wp);
+      m_freem(bp);
+      m_freem(wp);
       return NULL;
     }
     cp += olen - 4;
@@ -246,8 +246,8 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
   } else if (len + 4 != olen) {
     log_Printf(LogCCP, "Pred1: Length error (got %d, not %d)\n", len + 4, olen);
     fsm_Reopen(&ccp->fsm);
-    mbuf_Free(wp);
-    mbuf_Free(bp);
+    m_freem(wp);
+    m_freem(bp);
     return NULL;
   } else {
     ccp->compin += len;
@@ -257,21 +257,21 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
   }
   *pp++ = *cp++;		/* CRC */
   *pp++ = *cp++;
-  fcs = hdlc_Fcs(bufp, wp->cnt = pp - bufp);
+  fcs = hdlc_Fcs(bufp, wp->m_len = pp - bufp);
   if (fcs == GOODFCS) {
-    wp->offset += 2;		/* skip length */
-    wp->cnt -= 4;		/* skip length & CRC */
+    wp->m_offset += 2;		/* skip length */
+    wp->m_len -= 4;		/* skip length & CRC */
     pp = MBUF_CTOP(wp);
     *proto = *pp++;
     if (*proto & 1) {
-      wp->offset++;
-      wp->cnt--;
+      wp->m_offset++;
+      wp->m_len--;
     } else {
-      wp->offset += 2;
-      wp->cnt -= 2;
+      wp->m_offset += 2;
+      wp->m_len -= 2;
       *proto = (*proto << 8) | *pp++;
     }
-    mbuf_Free(bp);
+    m_freem(bp);
     return wp;
   } else {
     const char *pre = *MBUF_CTOP(bp) & 0x80 ? "" : "un";
@@ -280,9 +280,9 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp)
     log_Printf(LogCCP, "%s: Bad %scompressed CRC-16\n",
                ccp->fsm.link->name, pre);
     fsm_Reopen(&ccp->fsm);
-    mbuf_Free(wp);
+    m_freem(wp);
   }
-  mbuf_Free(bp);
+  m_freem(bp);
   return NULL;
 }
 
diff --git a/usr.sbin/ppp/proto.c b/usr.sbin/ppp/proto.c
index 685572fd5208..63513b339740 100644
--- a/usr.sbin/ppp/proto.c
+++ b/usr.sbin/ppp/proto.c
@@ -61,9 +61,9 @@ proto_Prepend(struct mbuf *bp, u_short proto, unsigned comp, int extra)
   cp[1] = proto & 0xff;
 
   if (comp && cp[0] == 0)
-    bp = mbuf_Prepend(bp, cp + 1, 1, extra);
+    bp = m_prepend(bp, cp + 1, 1, extra);
   else
-    bp = mbuf_Prepend(bp, cp, 2, extra);
+    bp = m_prepend(bp, cp, 2, extra);
 
   return bp;
 }
@@ -75,7 +75,7 @@ proto_LayerPush(struct bundle *b, struct link *l, struct mbuf *bp,
   log_Printf(LogDEBUG, "proto_LayerPush: Using 0x%04x\n", *proto);
   bp = proto_Prepend(bp, *proto, l->lcp.his_protocomp,
                      acf_WrapperOctets(&l->lcp, *proto));
-  mbuf_SetType(bp, MB_PROTOOUT);
+  m_settype(bp, MB_PROTOOUT);
   link_ProtocolRecord(l, *proto, PROTO_OUT);
 
   return bp;
@@ -89,14 +89,14 @@ proto_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp,
   size_t got;
 
   if ((got = mbuf_View(bp, cp, 2)) == 0) {
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
 
   *proto = cp[0];
   if (!(*proto & 1)) {
     if (got == 1) {
-      mbuf_Free(bp);
+      m_freem(bp);
       return NULL;
     }
     bp = mbuf_Read(bp, cp, 2);
@@ -105,7 +105,7 @@ proto_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp,
     bp = mbuf_Read(bp, cp, 1);
 
   log_Printf(LogDEBUG, "proto_LayerPull: unknown -> 0x%04x\n", *proto);
-  mbuf_SetType(bp, MB_PROTOIN);
+  m_settype(bp, MB_PROTOIN);
   link_ProtocolRecord(l, *proto, PROTO_IN);
 
   return bp;
diff --git a/usr.sbin/ppp/slcompress.c b/usr.sbin/ppp/slcompress.c
index 19bbb4ac945a..d5fa74c21391 100644
--- a/usr.sbin/ppp/slcompress.c
+++ b/usr.sbin/ppp/slcompress.c
@@ -153,9 +153,9 @@ sl_compress_tcp(struct mbuf * m,
    * (i.e., ACK isn't set or some other control bit is set).  (We assume that
    * the caller has already made sure the packet is IP proto TCP).
    */
-  if ((ip->ip_off & htons(0x3fff)) || m->cnt < 40) {
-    log_Printf(LogDEBUG, "??? 1 ip_off = %x, cnt = %d\n",
-	      ip->ip_off, m->cnt);
+  if ((ip->ip_off & htons(0x3fff)) || m->m_len < 40) {
+    log_Printf(LogDEBUG, "??? 1 ip_off = %x, m_len = %d\n",
+	      ip->ip_off, m->m_len);
     log_DumpBp(LogDEBUG, "", m);
     return (TYPE_IP);
   }
@@ -213,7 +213,7 @@ sl_compress_tcp(struct mbuf * m,
 #define	THOFFSET(th)	(th->th_off)
     hlen += th->th_off;
     hlen <<= 2;
-    if (hlen > m->cnt)
+    if (hlen > m->m_len)
       return (TYPE_IP);
     goto uncompressed;
 
@@ -245,7 +245,7 @@ found:
   deltaS = hlen;
   hlen += th->th_off;
   hlen <<= 2;
-  if (hlen > m->cnt)
+  if (hlen > m->m_len)
     return (TYPE_IP);
 
   if (((u_short *) ip)[0] != ((u_short *) & cs->cs_ip)[0] ||
@@ -384,8 +384,8 @@ found:
     *cp++ = changes | NEW_C;
     *cp++ = cs->cs_id;
   }
-  m->cnt -= hlen;
-  m->offset += hlen;
+  m->m_len -= hlen;
+  m->m_offset += hlen;
   *cp++ = deltaA >> 8;
   *cp++ = deltaA;
   memcpy(cp, new_seq, deltaS);
diff --git a/usr.sbin/ppp/sync.c b/usr.sbin/ppp/sync.c
index 29e5cbc3b4ff..9fd782aa33e0 100644
--- a/usr.sbin/ppp/sync.c
+++ b/usr.sbin/ppp/sync.c
@@ -53,7 +53,7 @@ sync_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
                 int pri, u_short *proto)
 {
   log_DumpBp(LogSYNC, "Write", bp);
-  mbuf_SetType(bp, MB_SYNCOUT);
+  m_settype(bp, MB_SYNCOUT);
   return bp;
 }
 
@@ -69,9 +69,9 @@ sync_LayerPull(struct bundle *b, struct link *l, struct mbuf *bp,
     log_DumpBp(LogSYNC, "Read", bp);
 
     /* Either done here or by the HDLC layer */
-    p->hdlc.lqm.SaveInOctets += mbuf_Length(bp) + 1;
+    p->hdlc.lqm.SaveInOctets += m_length(bp) + 1;
     p->hdlc.lqm.SaveInPackets++;
-    mbuf_SetType(bp, MB_SYNCIN);
+    m_settype(bp, MB_SYNCIN);
   }
 
   return bp;
diff --git a/usr.sbin/ppp/vjcomp.c b/usr.sbin/ppp/vjcomp.c
index 1395ba1335ed..5c9936248298 100644
--- a/usr.sbin/ppp/vjcomp.c
+++ b/usr.sbin/ppp/vjcomp.c
@@ -66,7 +66,7 @@ vj_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp, int pri,
   struct ip *pip;
   u_short cproto = bundle->ncp.ipcp.peer_compproto >> 16;
 
-  bp = mbuf_Contiguous(bp);
+  bp = m_pullup(bp);
   pip = (struct ip *)MBUF_CTOP(bp);
   if (*proto == PROTO_IP && pip->ip_p == IPPROTO_TCP &&
       cproto == PROTO_VJCOMP) {
@@ -81,18 +81,18 @@ vj_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp, int pri,
     case TYPE_UNCOMPRESSED_TCP:
       *proto = PROTO_VJUNCOMP;
       log_Printf(LogDEBUG, "vj_LayerPush: PROTO_IP -> PROTO_VJUNCOMP\n");
-      mbuf_SetType(bp, MB_VJOUT);
+      m_settype(bp, MB_VJOUT);
       break;
 
     case TYPE_COMPRESSED_TCP:
       *proto = PROTO_VJCOMP;
       log_Printf(LogDEBUG, "vj_LayerPush: PROTO_IP -> PROTO_VJUNCOMP\n");
-      mbuf_SetType(bp, MB_VJOUT);
+      m_settype(bp, MB_VJOUT);
       break;
 
     default:
       log_Printf(LogERROR, "vj_LayerPush: Unknown frame type %x\n", type);
-      mbuf_Free(bp);
+      m_freem(bp);
       return NULL;
     }
   }
@@ -108,8 +108,8 @@ VjUncompressTcp(struct ipcp *ipcp, struct mbuf *bp, u_char type)
   struct mbuf *nbp;
   u_char work[MAX_HDR + MAX_VJHEADER];	/* enough to hold TCP/IP header */
 
-  bp = mbuf_Contiguous(bp);
-  olen = len = mbuf_Length(bp);
+  bp = m_pullup(bp);
+  olen = len = m_length(bp);
   if (type == TYPE_UNCOMPRESSED_TCP) {
     /*
      * Uncompressed packet does NOT change its size, so that we can use mbuf
@@ -119,10 +119,10 @@ VjUncompressTcp(struct ipcp *ipcp, struct mbuf *bp, u_char type)
     len = sl_uncompress_tcp(&bufp, len, type, &ipcp->vj.cslc, &ipcp->vj.slstat,
                             (ipcp->my_compproto >> 8) & 255);
     if (len <= 0) {
-      mbuf_Free(bp);
+      m_freem(bp);
       bp = NULL;
     } else
-      mbuf_SetType(bp, MB_VJIN);
+      m_settype(bp, MB_VJIN);
     return bp;
   }
 
@@ -139,15 +139,15 @@ VjUncompressTcp(struct ipcp *ipcp, struct mbuf *bp, u_char type)
   len = sl_uncompress_tcp(&bufp, olen, type, &ipcp->vj.cslc, &ipcp->vj.slstat,
                           (ipcp->my_compproto >> 8) & 255);
   if (len <= 0) {
-    mbuf_Free(bp);
+    m_freem(bp);
     return NULL;
   }
   len -= olen;
   len += rlen;
-  nbp = mbuf_Alloc(len, MB_VJIN);
+  nbp = m_get(len, MB_VJIN);
   memcpy(MBUF_CTOP(nbp), bufp, len);
-  mbuf_SetType(bp, MB_VJIN);
-  nbp->next = bp;
+  m_settype(bp, MB_VJIN);
+  nbp->m_next = bp;
   return nbp;
 }