// File: /workspace/github_c_makefile_star2_O1/FH0[P]tun_direct/lwip-2.1.2/src/core/ipv6/ip6_frag.c
// Function: ip6_reass_free_complete_datagram
static void
ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
{
  struct ip6_reassdata *prev;
  u16_t pbufs_freed = 0;
  u16_t clen;
  struct pbuf *p;
  struct ip6_reass_helper *iprh;

#if LWIP_ICMP6
  iprh = (struct ip6_reass_helper *)ipr->p->payload;
  if (iprh->start == 0) {
    /* The first fragment was received, send ICMP time exceeded. */
    /* First, de-queue the first pbuf from r->p. */
    p = ipr->p;
    ipr->p = iprh->next_pbuf;
    /* Restore the part that we've overwritten with our helper structure, or we
     * might send garbage (and disclose a pointer) in the ICMPv6 reply. */
    MEMCPY(p->payload, ipr->orig_hdr, sizeof(iprh));
    /* Then, move back to the original ipv6 header (we are now pointing to Fragment header).
       This cannot fail since we already checked when receiving this fragment. */
    if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr))) {
      LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
    }
    else {
      /* Reconstruct the zoned source and destination addresses, so that we do
       * not end up sending the ICMP response over the wrong link. */
      ip6_addr_t src_addr, dest_addr;
      ip6_addr_copy_from_packed(src_addr, IPV6_FRAG_SRC(ipr));
      ip6_addr_set_zone(&src_addr, ipr->src_zone);
      ip6_addr_copy_from_packed(dest_addr, IPV6_FRAG_DEST(ipr));
      ip6_addr_set_zone(&dest_addr, ipr->dest_zone);
      /* Send the actual ICMP response. */
      icmp6_time_exceeded_with_addrs(p, ICMP6_TE_FRAG, &src_addr, &dest_addr);
    }
    clen = pbuf_clen(p);
    LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    pbufs_freed = (u16_t)(pbufs_freed + clen);
    pbuf_free(p);
  }
#endif /* LWIP_ICMP6 */

  /* First, free all received pbufs.  The individual pbufs need to be released
     separately as they have not yet been chained */
  p = ipr->p;
  while (p != NULL) {
    struct pbuf *pcur;
    iprh = (struct ip6_reass_helper *)p->payload;
    pcur = p;
    /* get the next pointer before freeing */
    p = iprh->next_pbuf;
    clen = pbuf_clen(pcur);
    LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    pbufs_freed = (u16_t)(pbufs_freed + clen);
    pbuf_free(pcur);
  }

  /* Then, unchain the struct ip6_reassdata from the list and free it. */
  if (ipr == reassdatagrams) {
    reassdatagrams = ipr->next;
  } else {
    prev = reassdatagrams;
    while (prev != NULL) {
      if (prev->next == ipr) {
        break;
      }
      prev = prev->next;
    }
    if (prev != NULL) {
      prev->next = ipr->next;
    }
  }
  memp_free(MEMP_IP6_REASSDATA, ipr);

  /* Finally, update number of pbufs in reassembly queue */
  LWIP_ASSERT("ip_reass_pbufcount >= clen", ip6_reass_pbufcount >= pbufs_freed);
  ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - pbufs_freed);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %rbx
subq $0x28, %rsp
movq %rdi, %rbx
movq 0x8(%rdi), %r14
movq 0x8(%r14), %rax
cmpw $0x0, 0x8(%rax)
je 0x10c87
xorl %ebp, %ebp
jmp 0x10d18
movq (%rax), %rcx
movq %rcx, 0x8(%rbx)
movq 0x38(%rbx), %rcx
movq %rcx, (%rax)
movl 0x8(%r14), %eax
subl 0x10(%rbx), %eax
movswl %ax, %esi
movq %r14, %rdi
callq 0x53c5
testb %al, %al
jne 0x10df1
movl 0x18(%rbx), %eax
leaq 0x14(%rsp), %rdx
movl %eax, (%rdx)
movl 0x1c(%rbx), %eax
movl %eax, 0x4(%rdx)
movl 0x20(%rbx), %eax
movl %eax, 0x8(%rdx)
movl 0x24(%rbx), %eax
movl %eax, 0xc(%rdx)
xorl %eax, %eax
movb %al, 0x10(%rdx)
movb 0x50(%rbx), %cl
movb %cl, 0x10(%rdx)
movl 0x28(%rbx), %esi
movq %rsp, %rcx
movl %esi, (%rcx)
movl 0x2c(%rbx), %esi
movl %esi, 0x4(%rcx)
movl 0x30(%rbx), %esi
movl %esi, 0x8(%rcx)
movl 0x34(%rbx), %esi
movl %esi, 0xc(%rcx)
movb %al, 0x10(%rcx)
movb 0x51(%rbx), %al
movb %al, 0x10(%rcx)
movq %r14, %rdi
movl $0x1, %esi
callq 0xf8fa
movq %r14, %rdi
callq 0x5425
movl %eax, %ebp
movq %r14, %rdi
callq 0x5069
movq 0x8(%rbx), %r14
testq %r14, %r14
je 0x10d50
movq 0x8(%r14), %rax
movq (%rax), %r15
movq %r14, %rdi
callq 0x5425
movzwl %bp, %ecx
movzwl %ax, %ebp
addl %ecx, %ebp
cmpl $0x10000, %ebp          # imm = 0x10000
jae 0x10da8
movq %r14, %rdi
callq 0x5069
movq %r15, %r14
testq %r15, %r15
jne 0x10d21
movq 0xcca1(%rip), %rcx      # 0x1d9f8
cmpq %rbx, %rcx
je 0x10d6e
testq %rcx, %rcx
je 0x10d7b
movq %rcx, %rax
movq (%rcx), %rcx
cmpq %rbx, %rcx
jne 0x10d5c
jmp 0x10d75
leaq 0xcc83(%rip), %rax      # 0x1d9f8
movq (%rbx), %rcx
movq %rcx, (%rax)
movl $0x9, %edi
movq %rbx, %rsi
callq 0x3d28
movzwl 0xcc71(%rip), %eax      # 0x1da00
cmpw %bp, %ax
jb 0x10dd5
subl %ebp, %eax
movw %ax, 0xcc63(%rip)       # 0x1da00
addq $0x28, %rsp
popq %rbx
popq %r14
popq %r15
popq %rbp
retq
leaq 0x451d(%rip), %rdi      # 0x152cc
leaq 0x6707(%rip), %rsi      # 0x174bd
leaq 0x693b(%rip), %rcx      # 0x176f8
movl $0xc7, %edx
xorl %eax, %eax
callq 0x20d0
xorl %edi, %edi
callq 0x21b0
callq 0x2050
leaq 0x44f0(%rip), %rdi      # 0x152cc
leaq 0x6613(%rip), %rsi      # 0x173f6
leaq 0x690e(%rip), %rcx      # 0x176f8
movl $0xde, %edx
jmp 0x10dc2
leaq 0x44d4(%rip), %rdi      # 0x152cc
leaq 0x69d3(%rip), %rsi      # 0x177d2
leaq 0x68f2(%rip), %rcx      # 0x176f8
movl $0xa9, %edx
jmp 0x10dc2