--- sys/netinet/ip_output.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fixsrc/sys/netinet/ip_output.c	2026-10-24 13:14:50.721342845 +0000
@@ -947,6 +947,10 @@
 		 * in the existing chain instead of rearranging it.
 		 */
 		m = m_pullup(m, offset + sizeof(u_short));
+		/* DF-2565 fix: m_pullup may fail; the old code also lost
+		 * the possibly-reallocated head for every caller. */
+		if (m == NULL)
+			return;
 	}
 	*(u_short *)(m->m_data + offset) = csum;
 }