I have an application that opens up a raw socket (SOCK_RAW), and is expecting to receive an ICMP packet.
In this case, depending on the kernel scheduling, sometimes the packet received includes the IP header, and sometimes not. This occurs because recv_raw (api_msg.c) posts the received packet into the applications mbox. However, it does not say that the packet has been processed (or "eaten" according to the sorrounding comments), so further layers continue processing the packet. Eventually it reaches icmp_input which moves the payload past the ip header.
It seems like the code in recv_raw should return 1 in cases where there is an application waiting for the input. I can see that this is ok to do for ICMP packets, but I'm not sure if it is generally applicable.
The issue exists in lwip-1.2.0, and at first glance appears to exist in lwip-1.3.0rc1 also.
/Siva -- In the end, everything is a gag. Charlie Chaplin