// File: /workspace/github_c_makefile_star2_O2/FH0[P]tun_direct/lwip-2.1.2/src/core/ipv6/ip6_frag.c
// Function: ip6_reass_free_complete_datagram
static void
ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
{
  struct ip6_reassdata *prev;
  u16_t pbufs_freed = 0;
  u16_t clen;
  struct pbuf *p;
  struct ip6_reass_helper *iprh;

#if LWIP_ICMP6
  iprh = (struct ip6_reass_helper *)ipr->p->payload;
  if (iprh->start == 0) {
    /* The first fragment was received, send ICMP time exceeded. */
    /* First, de-queue the first pbuf from r->p. */
    p = ipr->p;
    ipr->p = iprh->next_pbuf;
    /* Restore the part that we've overwritten with our helper structure, or we
     * might send garbage (and disclose a pointer) in the ICMPv6 reply. */
    MEMCPY(p->payload, ipr->orig_hdr, sizeof(iprh));
    /* Then, move back to the original ipv6 header (we are now pointing to Fragment header).
       This cannot fail since we already checked when receiving this fragment. */
    if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr))) {
      LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
    }
    else {
      /* Reconstruct the zoned source and destination addresses, so that we do
       * not end up sending the ICMP response over the wrong link. */
      ip6_addr_t src_addr, dest_addr;
      ip6_addr_copy_from_packed(src_addr, IPV6_FRAG_SRC(ipr));
      ip6_addr_set_zone(&src_addr, ipr->src_zone);
      ip6_addr_copy_from_packed(dest_addr, IPV6_FRAG_DEST(ipr));
      ip6_addr_set_zone(&dest_addr, ipr->dest_zone);
      /* Send the actual ICMP response. */
      icmp6_time_exceeded_with_addrs(p, ICMP6_TE_FRAG, &src_addr, &dest_addr);
    }
    clen = pbuf_clen(p);
    LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    pbufs_freed = (u16_t)(pbufs_freed + clen);
    pbuf_free(p);
  }
#endif /* LWIP_ICMP6 */

  /* First, free all received pbufs.  The individual pbufs need to be released
     separately as they have not yet been chained */
  p = ipr->p;
  while (p != NULL) {
    struct pbuf *pcur;
    iprh = (struct ip6_reass_helper *)p->payload;
    pcur = p;
    /* get the next pointer before freeing */
    p = iprh->next_pbuf;
    clen = pbuf_clen(pcur);
    LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    pbufs_freed = (u16_t)(pbufs_freed + clen);
    pbuf_free(pcur);
  }

  /* Then, unchain the struct ip6_reassdata from the list and free it. */
  if (ipr == reassdatagrams) {
    reassdatagrams = ipr->next;
  } else {
    prev = reassdatagrams;
    while (prev != NULL) {
      if (prev->next == ipr) {
        break;
      }
      prev = prev->next;
    }
    if (prev != NULL) {
      prev->next = ipr->next;
    }
  }
  memp_free(MEMP_IP6_REASSDATA, ipr);

  /* Finally, update number of pbufs in reassembly queue */
  LWIP_ASSERT("ip_reass_pbufcount >= clen", ip6_reass_pbufcount >= pbufs_freed);
  ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - pbufs_freed);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %rbx
subq $0x38, %rsp
movq %rdi, %rbx
movq 0x8(%rdi), %r14
movq 0x8(%r14), %rax
cmpw $0x0, 0x8(%rax)
je 0x101e8
xorl %ebp, %ebp
jmp 0x1027f
movq (%rax), %rcx
movq %rcx, 0x8(%rbx)
movq 0x38(%rbx), %rcx
movq %rcx, (%rax)
movl 0x8(%r14), %eax
subl 0x10(%rbx), %eax
movswl %ax, %esi
movq %r14, %rdi
callq 0x5177
testb %al, %al
jne 0x10323
movups 0x18(%rbx), %xmm0
leaq 0x20(%rsp), %rdx
movaps %xmm0, (%rdx)
movb 0x50(%rbx), %al
movb %al, 0x10(%rdx)
movups 0x28(%rbx), %xmm0
movq %rsp, %rcx
movaps %xmm0, (%rcx)
movb 0x51(%rbx), %al
movb %al, 0x10(%rcx)
pushq $0x1
popq %rsi
movq %r14, %rdi
callq 0xef63
movq %r14, %rdi
callq 0x51c5
movl %eax, %ebp
movq %r14, %rdi
callq 0x4e16
movq 0x8(%rbx), %r14
jmp 0x1027f
movq 0x8(%r14), %rax
movq (%rax), %r15
movq %r14, %rdi
callq 0x51c5
movzwl %bp, %ecx
movzwl %ax, %ebp
addl %ecx, %ebp
cmpl $0x10000, %ebp          # imm = 0x10000
jae 0x102da
movq %r14, %rdi
callq 0x4e16
movq %r15, %r14
testq %r14, %r14
jne 0x10255
movq 0xd77d(%rip), %rcx      # 0x1da08
cmpq %rbx, %rcx
je 0x102a2
testq %rcx, %rcx
je 0x102af
movq %rcx, %rax
movq (%rcx), %rcx
cmpq %rbx, %rcx
jne 0x10290
jmp 0x102a9
leaq 0xd75f(%rip), %rax      # 0x1da08
movq (%rbx), %rcx
movq %rcx, (%rax)
pushq $0x9
popq %rdi
movq %rbx, %rsi
callq 0x3bcd
movzwl 0xd74f(%rip), %eax      # 0x1da10
cmpw %bp, %ax
jb 0x10307
subl %ebp, %eax
movw %ax, 0xd741(%rip)       # 0x1da10
addq $0x38, %rsp
popq %rbx
popq %r14
popq %r15
popq %rbp
retq
leaq 0x3feb(%rip), %rdi      # 0x142cc
leaq 0x61b5(%rip), %rsi      # 0x1649d
leaq 0x63c9(%rip), %rcx      # 0x166b8
movl $0xc7, %edx
xorl %eax, %eax
callq 0x20d0
xorl %edi, %edi
callq 0x21b0
callq 0x2050
leaq 0x3fbe(%rip), %rdi      # 0x142cc
leaq 0x60c1(%rip), %rsi      # 0x163d6
leaq 0x639c(%rip), %rcx      # 0x166b8
movl $0xde, %edx
jmp 0x102f4
leaq 0x3fa2(%rip), %rdi      # 0x142cc
leaq 0x6461(%rip), %rsi      # 0x16792
leaq 0x6380(%rip), %rcx      # 0x166b8
movl $0xa9, %edx
jmp 0x102f4