pm_results[i] contains the alproto, so e.g. ALPROTO_HTTP. al_proto_table[ALPROTO_HTTP].pp_alproto_map[dir](...) then runs the probing parsers for HTTP, which returns either ALPROTO_HTTP or ALPROTO_UNKNOWN, right? pp_alproto_map appears to be a func ptr then, but not one with correct casing.