On 05/27/2014 08:20 AM, Alexei Starovoitov wrote:
...

quoted

+                       BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 2),
+                       BPF_STMT(BPF_MISC | BPF_TAX, 0x5), /* libpcap emits K on TAX */

interesting observation. It means that libpcap doesn't init memory
properly and other fields just have junk in them?
and because it was doing it forever we need to accept such 'valid'
instructions? Oh well. ok.

Hmm, doesn't look like totally random. Perhaps they're
storing some intermediate value in it or something, and
don't clear that out as we have accepted that since ever,
but that shouldn't do anything anyway here. ;)