// File: /workspace/github_c_makefile_star2_O3/FH0[P]tun_direct/lwip-2.1.2/src/core/ipv6/ip6_frag.c
// Function: ip6_reass_free_complete_datagram
static void
ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
{
  struct ip6_reassdata *prev;
  u16_t pbufs_freed = 0;
  u16_t clen;
  struct pbuf *p;
  struct ip6_reass_helper *iprh;

#if LWIP_ICMP6
  iprh = (struct ip6_reass_helper *)ipr->p->payload;
  if (iprh->start == 0) {
    /* The first fragment was received, send ICMP time exceeded. */
    /* First, de-queue the first pbuf from r->p. */
    p = ipr->p;
    ipr->p = iprh->next_pbuf;
    /* Restore the part that we've overwritten with our helper structure, or we
     * might send garbage (and disclose a pointer) in the ICMPv6 reply. */
    MEMCPY(p->payload, ipr->orig_hdr, sizeof(iprh));
    /* Then, move back to the original ipv6 header (we are now pointing to Fragment header).
       This cannot fail since we already checked when receiving this fragment. */
    if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr))) {
      LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
    }
    else {
      /* Reconstruct the zoned source and destination addresses, so that we do
       * not end up sending the ICMP response over the wrong link. */
      ip6_addr_t src_addr, dest_addr;
      ip6_addr_copy_from_packed(src_addr, IPV6_FRAG_SRC(ipr));
      ip6_addr_set_zone(&src_addr, ipr->src_zone);
      ip6_addr_copy_from_packed(dest_addr, IPV6_FRAG_DEST(ipr));
      ip6_addr_set_zone(&dest_addr, ipr->dest_zone);
      /* Send the actual ICMP response. */
      icmp6_time_exceeded_with_addrs(p, ICMP6_TE_FRAG, &src_addr, &dest_addr);
    }
    clen = pbuf_clen(p);
    LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    pbufs_freed = (u16_t)(pbufs_freed + clen);
    pbuf_free(p);
  }
#endif /* LWIP_ICMP6 */

  /* First, free all received pbufs.  The individual pbufs need to be released
     separately as they have not yet been chained */
  p = ipr->p;
  while (p != NULL) {
    struct pbuf *pcur;
    iprh = (struct ip6_reass_helper *)p->payload;
    pcur = p;
    /* get the next pointer before freeing */
    p = iprh->next_pbuf;
    clen = pbuf_clen(pcur);
    LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    pbufs_freed = (u16_t)(pbufs_freed + clen);
    pbuf_free(pcur);
  }

  /* Then, unchain the struct ip6_reassdata from the list and free it. */
  if (ipr == reassdatagrams) {
    reassdatagrams = ipr->next;
  } else {
    prev = reassdatagrams;
    while (prev != NULL) {
      if (prev->next == ipr) {
        break;
      }
      prev = prev->next;
    }
    if (prev != NULL) {
      prev->next = ipr->next;
    }
  }
  memp_free(MEMP_IP6_REASSDATA, ipr);

  /* Finally, update number of pbufs in reassembly queue */
  LWIP_ASSERT("ip_reass_pbufcount >= clen", ip6_reass_pbufcount >= pbufs_freed);
  ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - pbufs_freed);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %rbx
subq $0x38, %rsp
movq %rdi, %rbx
movq 0x8(%rdi), %r14
movq 0x8(%r14), %rax
cmpw $0x0, 0x8(%rax)
je 0x107d4
xorl %ebp, %ebp
jmp 0x10846
movq (%rax), %rcx
movq %rcx, 0x8(%rbx)
movq 0x38(%rbx), %rcx
movq %rcx, (%rax)
movl 0x8(%r14), %eax
subl 0x10(%rbx), %eax
movswl %ax, %esi
movq %r14, %rdi
callq 0x5335
testb %al, %al
jne 0x10916
movups 0x18(%rbx), %xmm0
leaq 0x20(%rsp), %rdx
movaps %xmm0, (%rdx)
movb 0x50(%rbx), %al
movb %al, 0x10(%rdx)
movups 0x28(%rbx), %xmm0
movq %rsp, %rcx
movaps %xmm0, (%rcx)
movb 0x51(%rbx), %al
movb %al, 0x10(%rcx)
movq %r14, %rdi
movl $0x1, %esi
callq 0xf55a
movq %r14, %rdi
callq 0x539e
movl %eax, %ebp
movq %r14, %rdi
callq 0x4fdf
movq 0x8(%rbx), %r14
testq %r14, %r14
je 0x10875
movq 0x8(%r14), %rax
movq (%rax), %r15
movq %r14, %rdi
callq 0x539e
movzwl %bp, %ecx
movzwl %ax, %ebp
addl %ecx, %ebp
cmpl $0x10000, %ebp          # imm = 0x10000
jae 0x108cd
movq %r14, %rdi
callq 0x4fdf
movq %r15, %r14
testq %r15, %r15
jne 0x10846
movq 0xc17c(%rip), %rcx      # 0x1c9f8
cmpq %rbx, %rcx
je 0x10893
testq %rcx, %rcx
je 0x108a0
movq %rcx, %rax
movq (%rcx), %rcx
cmpq %rbx, %rcx
jne 0x10881
jmp 0x1089a
leaq 0xc15e(%rip), %rax      # 0x1c9f8
movq (%rbx), %rcx
movq %rcx, (%rax)
movl $0x9, %edi
movq %rbx, %rsi
callq 0x3cf8
movzwl 0xc14c(%rip), %eax      # 0x1ca00
cmpw %bp, %ax
jb 0x108fa
subl %ebp, %eax
movw %ax, 0xc13e(%rip)       # 0x1ca00
addq $0x38, %rsp
popq %rbx
popq %r14
popq %r15
popq %rbp
retq
leaq 0x39f8(%rip), %rdi      # 0x142cc
leaq 0x5baa(%rip), %rsi      # 0x16485
leaq 0x5d46(%rip), %rcx      # 0x16628
movl $0xc7, %edx
xorl %eax, %eax
callq 0x20d0
xorl %edi, %edi
callq 0x21b0
callq 0x2050
leaq 0x39cb(%rip), %rdi      # 0x142cc
leaq 0x5ab6(%rip), %rsi      # 0x163be
leaq 0x5d19(%rip), %rcx      # 0x16628
movl $0xde, %edx
jmp 0x108e7
leaq 0x39af(%rip), %rdi      # 0x142cc
leaq 0x5dfc(%rip), %rsi      # 0x16720
leaq 0x5cfd(%rip), %rcx      # 0x16628
movl $0xa9, %edx
jmp 0x108e7