Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/icmp6.h
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/icmp6.h	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/icmp6.h	(revision 364)
@@ -291,6 +291,6 @@
 typedef struct t_router_advert_hdr {
 	T_ICMP6_HDR	hdr;
-	uint32_t	reachable;		/* [ms] 到達可能時間	*/
-	uint32_t	retransmit;		/* [ms] 近隣要請送信間隔	*/
+	uint32_t	reachable;		/* [us] 到達可能時間	*/
+	uint32_t	retransmit;		/* [us] 近隣要請送信間隔	*/
 	/* この後にオプションが続く */
 	} __attribute__((packed, aligned(2))) T_ROUTER_ADVERT_HDR;
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/in4_subr.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/in4_subr.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/in4_subr.c	(revision 364)
@@ -287,6 +287,9 @@
 
 	/* IP ヘッダを設定する。*/
-	if ((error = in4_set_header(*nbuf, len, dstaddr, srcaddr, proto, ttl)) != E_OK)
+	if ((error = in4_set_header(*nbuf, len, dstaddr, srcaddr, proto, ttl)) != E_OK) {
+		syscall(rel_net_buf(*nbuf));
+		*nbuf = NULL;
 		return error;
+		}
 
 	/* 4 オクテット境界までパディングで埋める。*/
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/in_itron.h
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/in_itron.h	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/in_itron.h	(revision 364)
@@ -62,5 +62,5 @@
 #define TFN_TCP_ALL		(0)
 
-#define TEV_TCP_RCV_OOB		(-0x201)
+#define TEV_TCP_RCV_OOB		(0x201)
 
 /* UDP 関係 */
@@ -75,5 +75,5 @@
 #define TFN_UDP_ALL		(0)
 
-#define TEV_UDP_RCV_DAT		(-0x221)
+#define TEV_UDP_RCV_DAT		(0x221)
 
 /* 一般 */
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_input.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_input.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_input.c	(revision 364)
@@ -1364,4 +1364,8 @@
 	NTOHS(tcph->dport);
 
+	/* SDU 長 より 緊急ポインタが大きい場合 */
+	if (tcph->urp > tcph->sum)
+		goto drop;
+
 find_cep:
 
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_output.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_output.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_output.c	(revision 364)
@@ -369,6 +369,8 @@
 		tcph->flags |= TCP_FLG_URG;
 		}
-	else
+	else {
+		tcph->urp = 0;
 		cep->snd_up  = cep->snd_una;
+		}
 
 #endif	/* of #ifdef TCP_CFG_EXTENTIONS */
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_usrreq.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_usrreq.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/tcp_usrreq.c	(revision 364)
@@ -897,5 +897,5 @@
 
 	/* tcp_rcv_buf の割当て長をリセットする。*/
-	cep->rcv_buf_len = 0;
+	cep->rcv_buf_len -= len;
 
 	/* 通信端点のロックを解除する。*/
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udp_var.h
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udp_var.h	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udp_var.h	(revision 364)
@@ -101,4 +101,14 @@
 typedef ER	(*t_udp_callback)(ID cepid, FN fncd, void *p_parblk);
 
+typedef struct t_udp_rcv_dat_para {
+	uint_t		len;
+	T_NET_BUF	*input;
+	uint_t		off;
+	union {
+		T_IPV4EP rep4;
+		T_IPV6EP rep6;
+	};
+	} T_UDP_RCV_DAT_PARA;
+
 /*
  *  UDP 通信端点
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_input.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_input.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_input.c	(revision 364)
@@ -75,8 +75,8 @@
 {
 	T_UDP_HDR	*udph;
-	uint_t		len;
+	T_UDP_RCV_DAT_PARA para;
 
 	udph = (T_UDP_HDR *)(input->buf + off);
-	len  = (uint_t)(ntohs(udph->ulen) - UDP_HDR_SIZE);
+	para.len  = (uint_t)(ntohs(udph->ulen) - UDP_HDR_SIZE);
 
 	if (cep->rcv_tskid != TA_NULL) {	/* 非ノンブロッキングコールでペンディング中 */
@@ -98,5 +98,5 @@
 		/* データをバッファに移す。*/
 		memcpy(cep->rcv_data, GET_UDP_SDU(input, off),
-		       (size_t)(len < cep->rcv_len ? len : cep->rcv_len));
+		       (size_t)(para.len < cep->rcv_len ? para.len : cep->rcv_len));
 		syscall(rel_net_buf(input));
 
@@ -104,7 +104,7 @@
 
 #ifdef TCP_CFG_NON_BLOCKING_COMPAT14
-			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_RCV_DAT, (void*)(uint32_t)len);
+			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_RCV_DAT, (void*)(uint32_t)para.len);
 #else
-			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_RCV_DAT, (void*)&len);
+			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_RCV_DAT, (void*)&para.len);
 #endif
 		else
@@ -121,7 +121,16 @@
 
 #ifdef TCP_CFG_NON_BLOCKING_COMPAT14
-		(*cep->callback)(GET_UDP_CEPID(cep), TEV_UDP_RCV_DAT, (void*)(uint32_t)len);
+		(*cep->callback)(GET_UDP_CEPID(cep), TEV_UDP_RCV_DAT, (void*)(uint32_t)para.len);
 #else
-		(*cep->callback)(GET_UDP_CEPID(cep), TEV_UDP_RCV_DAT, (void*)&len);
+		para.input = input;
+		para.off = off;
+#if API_PROTO == API_PROTO_IPV4
+		para.rep4.portno = ntohs(udph->sport);
+		IN_COPY_TO_HOST(&para.rep4.ipaddr, input);
+#else
+		para.rep6.portno = ntohs(udph->sport);
+		IN_COPY_TO_HOST(&para.rep6.ipaddr, input);
+#endif
+		(*cep->callback)(GET_UDP_CEPID(cep), TEV_UDP_RCV_DAT, (void*)&para.len);
 #endif
 		/*
@@ -129,6 +138,9 @@
 		 *  データを読み出さなかったことになるので、捨てる。
 		 */
-		if (cep->cb_netbuf != NULL)
-			syscall(rel_net_buf(cep->cb_netbuf));
+		if (cep->cb_netbuf != NULL) {
+			if ((input->flags & NB_FLG_NOREL_IFOUT) == 0)
+				syscall(rel_net_buf(cep->cb_netbuf));
+			cep->cb_netbuf = NULL;
+			}
 		}
 	else {
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_usrreq.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_usrreq.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_usrreq.c	(revision 364)
@@ -411,6 +411,5 @@
 		return E_NOEXS;
 #if defined(SUPPORT_INET6)
-#endif
-#if defined(SUPPORT_INET4) && defined(SUPPORT_IGMP) && TNUM_UDP4_CEPID > 0
+#elif defined(SUPPORT_INET4) && defined(SUPPORT_IGMP) && TNUM_UDP4_CEPID > 0
 	switch (optname) {
 	case IP_MULTICAST_LOOP:
@@ -488,6 +487,5 @@
 		return E_NOEXS;
 #if defined(SUPPORT_INET6)
-#endif
-#if defined(SUPPORT_INET4) && defined(SUPPORT_IGMP) && TNUM_UDP4_CEPID > 0
+#elif defined(SUPPORT_INET4) && defined(SUPPORT_IGMP) && TNUM_UDP4_CEPID > 0
 	switch (optname) {
 	case IP_MULTICAST_LOOP:
Index: asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_usrreq_nblk.c
===================================================================
--- asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_usrreq_nblk.c	(revision 352)
+++ asp3_tinet_ecnl_arm/trunk/asp3_dcre/tinet/netinet/udpn_usrreq_nblk.c	(revision 364)
@@ -122,7 +122,7 @@
 
 #ifdef TCP_CFG_NON_BLOCKING_COMPAT14
-			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_RCV_DAT, (void*)error);
+			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_CAN_CEP, (void*)error);
 #else
-			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_RCV_DAT, (void*)&error);
+			(*cep->callback)(GET_UDP_CEPID(cep), TFN_UDP_CAN_CEP, (void*)&error);
 #endif
 		else
