6732010 ral driver needs lint clean-up

6732012 wpa needs the E_BAD_PTR_CAST_ALIGN lint tags to be removed from Makefile
6732019 ath driver needs lint clean-up
6732027 iwk needs to remove lint tags from Makfile
6732028 pcan needs lint tags E_PTRDIFF_OVERFLOW to be removed from Makefile
6732031 net80211 module needs lint tags E_PTRDIFF_OVERFLOW to be removed from Makfile

21 files changed, 212 insertions, 204 deletions

diff --git a/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile b/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile
index 7f649e7668..7aec89d375 100644
--- a/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile
+++ b/usr/src/cmd/cmd-inet/usr.lib/wpad/Makefile
@@ -19,7 +19,7 @@
 # CDDL HEADER END
 #
 #
-# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 # ident	"%Z%%M%	%I%	%E% SMI"
@@ -40,7 +40,7 @@ LDLIBS    += 	-ldladm -ldlpi
 all install := LDLIBS += -lcrypto
 
 CPPFLAGS  += 	-I/usr/sfw/include
-LINTFLAGS += 	-u -erroff=E_BAD_PTR_CAST_ALIGN
+LINTFLAGS += 	-u
 
 .KEEP_STATE:
 
diff --git a/usr/src/cmd/cmd-inet/usr.lib/wpad/driver_wifi.c b/usr/src/cmd/cmd-inet/usr.lib/wpad/driver_wifi.c
index 01ca5cea5e..15eaa19374 100644
--- a/usr/src/cmd/cmd-inet/usr.lib/wpad/driver_wifi.c
+++ b/usr/src/cmd/cmd-inet/usr.lib/wpad/driver_wifi.c
@@ -221,7 +221,7 @@ wpa_driver_wifi_set_key(datalink_id_t linkid, wpa_alg alg,
 	wpa_printf(MSG_DEBUG, "wpa_driver_wifi_set_key: alg=%s key_idx=%d"
 	    " set_tx=%d seq_len=%d seq=%d key_len=%d",
 	    alg_name, key_idx, set_tx,
-	    seq_len, *(uint64_t *)seq, key_len);
+	    seq_len, *(uint64_t *)(uintptr_t)seq, key_len);
 
 	if (seq_len > sizeof (uint64_t)) {
 		wpa_printf(MSG_DEBUG, "wpa_driver_wifi_set_key:"
@@ -231,7 +231,7 @@ wpa_driver_wifi_set_key(datalink_id_t linkid, wpa_alg alg,
 	(void) memcpy(bss.wb_bytes, addr, DLADM_WLAN_BSSID_LEN);
 
 	status = dladm_wlan_wpa_set_key(linkid, cipher, &bss, set_tx,
-	    *(uint64_t *)seq, key_idx, key, key_len);
+	    *(uint64_t *)(uintptr_t)seq, key_idx, key, key_len);
 
 	return (WPA_STATUS(status));
 }
diff --git a/usr/src/cmd/cmd-inet/usr.lib/wpad/wpa_supplicant.c b/usr/src/cmd/cmd-inet/usr.lib/wpad/wpa_supplicant.c
index 889d671b48..1bc2953afe 100644
--- a/usr/src/cmd/cmd-inet/usr.lib/wpad/wpa_supplicant.c
+++ b/usr/src/cmd/cmd-inet/usr.lib/wpad/wpa_supplicant.c
@@ -580,6 +580,7 @@ event_handler(void *cookie, char *argp, size_t asize,
 {
 	wpa_event_type event;
 
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
 	event = ((wl_events_t *)argp)->event;
 	wpa_event_handler(cookie, event);
 
diff --git a/usr/src/uts/common/io/ath/ath_aux.c b/usr/src/uts/common/io/ath/ath_aux.c
index 093250e171..e2ac721bd5 100644
--- a/usr/src/uts/common/io/ath/ath_aux.c
+++ b/usr/src/uts/common/io/ath/ath_aux.c
@@ -230,7 +230,7 @@ ath_setcurmode(ath_t *asc, enum ieee80211_phymode mode)
 	ASSERT(rt != NULL);
 
 	for (i = 0; i < rt->rateCount; i++)
-		asc->asc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
+		asc->asc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = (uint8_t)i;
 
 	asc->asc_currates = rt;
 	asc->asc_curmode = mode;
diff --git a/usr/src/uts/common/io/ath/ath_main.c b/usr/src/uts/common/io/ath/ath_main.c
index dab7e138b4..a85025c3c0 100644
--- a/usr/src/uts/common/io/ath/ath_main.c
+++ b/usr/src/uts/common/io/ath/ath_main.c
@@ -797,6 +797,7 @@ ath_tx_start(ath_t *asc, struct ieee80211_node *in, struct ath_buf *bf,
 		uint16_t dur;
 		dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE,
 		    rix, shortPreamble);
+		/* LINTED E_BAD_PTR_CAST_ALIGN */
 		*(uint16_t *)wh->i_dur = LE_16(dur);
 	}
 
@@ -855,6 +856,7 @@ ath_tx_start(ath_t *asc, struct ieee80211_node *in, struct ath_buf *bf,
 	    ctsduration);		/* rts/cts duration */
 	bf->bf_flags = flags;
 
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
 	ATH_DEBUG((ATH_DBG_SEND, "ath: ath_xmit(): to %s totlen=%d "
 	    "an->an_tx_rate1sp=%d tx_rate2sp=%d tx_rate3sp=%d "
 	    "qnum=%d rix=%d sht=%d dur = %d\n",
@@ -981,6 +983,7 @@ ath_xmit(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
 			tsf = ATH_HAL_GETTSF64(ah);
 			/* adjust 100us delay to xmit */
 			tsf += 100;
+			/* LINTED E_BAD_PTR_CAST_ALIGN */
 			tstamp = (uint32_t *)&wh[1];
 			tstamp[0] = LE_32(tsf & 0xffffffff);
 			tstamp[1] = LE_32(tsf >> 32);
@@ -1439,6 +1442,7 @@ ath_watchdog(void *arg)
 static uint_t
 ath_intr(caddr_t arg)
 {
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
 	ath_t *asc = (ath_t *)arg;
 	struct ath_hal *ah = asc->asc_ah;
 	HAL_INT status;
@@ -1509,6 +1513,7 @@ reset:
 static uint_t
 ath_softint_handler(caddr_t data)
 {
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
 	ath_t *asc = (ath_t *)data;
 
 	/*
diff --git a/usr/src/uts/common/io/ath/ath_rate.c b/usr/src/uts/common/io/ath/ath_rate.c
index d8cc78b845..7310b164ad 100644
--- a/usr/src/uts/common/io/ath/ath_rate.c
+++ b/usr/src/uts/common/io/ath/ath_rate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -167,7 +167,7 @@ ath_rate_ctl_start(ath_t *asc, struct ieee80211_node *in)
 			 */
 			/* NB: the rate set is assumed sorted */
 			for (; srate >= 0 && IEEE80211_RATE(srate) > 72;
-			    srate--);
+			    srate--) {}
 		}
 	} else {
 		/*
@@ -178,7 +178,7 @@ ath_rate_ctl_start(ath_t *asc, struct ieee80211_node *in)
 		/* NB: the rate set is assumed sorted */
 		srate = in->in_rates.ir_nrates - 1;
 		for (; srate >= 0 && IEEE80211_RATE(srate) != ic->ic_fixed_rate;
-		    srate--);
+		    srate--) {}
 	}
 	ATH_DEBUG((ATH_DBG_RATE, "ath: ath_rate_ctl_start(): "
 	    "srate=%d rate=%d\n", srate, IEEE80211_RATE(srate)));
@@ -297,7 +297,8 @@ ath_rate_ctl(ieee80211com_t *isc, struct ieee80211_node *in)
 void
 ath_rate_setup(ath_t *asc, uint32_t mode)
 {
-	int32_t i, maxrates;
+	int32_t i;
+	uint8_t maxrates;
 	struct ieee80211_rateset *rs;
 	struct ath_hal *ah = asc->asc_ah;
 	ieee80211com_t *ic = (ieee80211com_t *)asc;
diff --git a/usr/src/uts/common/io/iwk/iwk2.c b/usr/src/uts/common/io/iwk/iwk2.c
index a7b0418aa1..0d87701db7 100644
--- a/usr/src/uts/common/io/iwk/iwk2.c
+++ b/usr/src/uts/common/io/iwk/iwk2.c
@@ -1252,10 +1252,10 @@ iwk_alloc_tx_ring(iwk_sc_t *sc, iwk_tx_ring_t *ring,
 
 		data->desc = desc_h + i;
 		data->paddr_desc = paddr_desc_h +
-		    ((caddr_t)data->desc - (caddr_t)desc_h);
+		    _PTRDIFF(data->desc, desc_h);
 		data->cmd = cmd_h +  i; /* (i % slots); */
 		data->paddr_cmd = paddr_cmd_h +
-		    ((caddr_t)data->cmd - (caddr_t)cmd_h);
+		    _PTRDIFF(data->cmd, cmd_h);
 		    /* ((i % slots) * sizeof (iwk_cmd_t)); */
 	}
 	dma_p = &ring->data[0].dma_data;
@@ -3085,7 +3085,7 @@ iwk_scan(iwk_sc_t *sc)
 	}
 
 	/* setup length of probe request */
-	hdr->tx_cmd.len = LE_16(frm - (uint8_t *)wh);
+	hdr->tx_cmd.len = LE_16(_PTRDIFF(frm, wh));
 	hdr->len = hdr->nchan * sizeof (iwk_scan_chan_t) +
 	    hdr->tx_cmd.len + sizeof (iwk_scan_hdr_t);
 
@@ -3105,7 +3105,7 @@ iwk_scan(iwk_sc_t *sc)
 		frm += sizeof (iwk_scan_chan_t);
 	}
 
-	pktlen = frm - (uint8_t *)cmd;
+	pktlen = _PTRDIFF(frm, cmd);
 
 	(void) memset(desc, 0, sizeof (*desc));
 	desc->val0 = LE_32(1 << 24);
diff --git a/usr/src/uts/common/io/net80211/net80211_crypto.c b/usr/src/uts/common/io/net80211/net80211_crypto.c
index 978be371c7..ea9fce911a 100644
--- a/usr/src/uts/common/io/net80211/net80211_crypto.c
+++ b/usr/src/uts/common/io/net80211/net80211_crypto.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -44,6 +44,7 @@
 #include <sys/note.h>
 #include <sys/crypto/common.h>
 #include <sys/crypto/api.h>
+#include <sys/strsun.h>
 #include "net80211_impl.h"
 
 extern const struct ieee80211_cipher wep;
@@ -413,10 +414,10 @@ ieee80211_crypto_decap(ieee80211com_t *ic, mblk_t *mp, int hdrlen)
 	uint8_t keyid;
 
 	/* NB: this minimum size data frame could be bigger */
-	if ((mp->b_wptr - mp->b_rptr) < IEEE80211_WEP_MINLEN) {
+	if (MBLKL(mp) < IEEE80211_WEP_MINLEN) {
 		ieee80211_dbg(IEEE80211_MSG_CRYPTO, "ieee80211_crypto_decap:"
 		    " WEP data frame too short, len %u\n",
-		    mp->b_wptr - mp->b_rptr);
+		    MBLKL(mp));
 		return (NULL);
 	}
 	/*
diff --git a/usr/src/uts/common/io/net80211/net80211_crypto_ccmp.c b/usr/src/uts/common/io/net80211/net80211_crypto_ccmp.c
index 9f41cc3f42..5acc621e4c 100644
--- a/usr/src/uts/common/io/net80211/net80211_crypto_ccmp.c
+++ b/usr/src/uts/common/io/net80211/net80211_crypto_ccmp.c
@@ -45,6 +45,7 @@
 #include <sys/crypto/api.h>
 #include <sys/crc32.h>
 #include <sys/random.h>
+#include <sys/strsun.h>
 #include "net80211_impl.h"
 
 struct ccmp_ctx {
@@ -425,7 +426,7 @@ ccmp_encrypt(struct ieee80211_key *key, mblk_t *mp, int hdrlen)
 	uint8_t buf[IEEE80211_MAX_LEN];
 
 	wh = (struct ieee80211_frame *)mp->b_rptr;
-	data_len = (mp->b_wptr - mp->b_rptr) - (hdrlen + ccmp.ic_header);
+	data_len = MBLKL(mp) - (hdrlen + ccmp.ic_header);
 	pos = mp->b_rptr + hdrlen + ccmp.ic_header;
 
 	ccmp_init(wh, key->wk_keytsc, data_len, b0, aad);
@@ -458,7 +459,7 @@ ccmp_decrypt(struct ieee80211_key *key, uint64_t pn, mblk_t *mp, int hdrlen)
 	uint8_t buf[IEEE80211_MAX_LEN];
 
 	wh = (struct ieee80211_frame *)mp->b_rptr;
-	data_len = (mp->b_wptr - mp->b_rptr) - (hdrlen + ccmp.ic_header);
+	data_len = MBLKL(mp) - (hdrlen + ccmp.ic_header);
 	pos = mp->b_rptr + hdrlen + ccmp.ic_header;
 
 	ccmp_init(wh, pn, data_len, b0, aad);
diff --git a/usr/src/uts/common/io/net80211/net80211_crypto_tkip.c b/usr/src/uts/common/io/net80211/net80211_crypto_tkip.c
index be28369a3b..e4caf46de3 100644
--- a/usr/src/uts/common/io/net80211/net80211_crypto_tkip.c
+++ b/usr/src/uts/common/io/net80211/net80211_crypto_tkip.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -50,6 +50,7 @@
 #include <sys/crypto/api.h>
 #include <sys/crc32.h>
 #include <sys/random.h>
+#include <sys/strsun.h>
 #include "net80211_impl.h"
 
 static void *tkip_attach(struct ieee80211com *, struct ieee80211_key *);
@@ -267,13 +268,13 @@ tkip_enmic(struct ieee80211_key *k, mblk_t *mp, int force)
 		mic = mp->b_wptr;
 		mp->b_wptr += tkip.ic_miclen;
 
-		if ((int)((mp->b_wptr - mp->b_rptr)
-		    - (hdrlen + tkip.ic_header + tkip.ic_miclen)) < 0)
+		if ((int)(MBLKL(mp) -
+		    (hdrlen + tkip.ic_header + tkip.ic_miclen)) < 0)
 			return (0);	/* dead packet */
 
 		michael_mic(ctx, k->wk_txmic, mp, (hdrlen + tkip.ic_header),
-		    (mp->b_wptr - mp->b_rptr)
-		    - (hdrlen + tkip.ic_header + tkip.ic_miclen), mic);
+		    MBLKL(mp) -
+		    (hdrlen + tkip.ic_header + tkip.ic_miclen), mic);
 	}
 	return (1);
 }
@@ -294,7 +295,7 @@ tkip_demic(struct ieee80211_key *k, mblk_t *mp, int force)
 
 		michael_mic(ctx, k->wk_rxmic,
 		    mp, hdrlen,
-		    (mp->b_wptr - mp->b_rptr) - (hdrlen + tkip.ic_miclen),
+		    MBLKL(mp) - (hdrlen + tkip.ic_miclen),
 		    mic);
 		bcopy(mp->b_wptr - tkip.ic_miclen, mic0, tkip.ic_miclen);
 		if (bcmp(mic, mic0, tkip.ic_miclen)) {
@@ -721,8 +722,8 @@ tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
 
 	(void) wep_encrypt(ctx->tx_rc4key,
 	    mp, hdrlen + tkip.ic_header,
-	    (mp->b_wptr - mp->b_rptr)
-	    - (hdrlen + tkip.ic_header + tkip.ic_trailer),
+	    MBLKL(mp) -
+	    (hdrlen + tkip.ic_header + tkip.ic_trailer),
 	    icv);
 
 	key->wk_keytsc++;
@@ -754,8 +755,8 @@ tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
 	/* m is unstripped; deduct headers + ICV to get payload */
 	if (!wep_decrypt(ctx->rx_rc4key,
 	    mp, hdrlen + tkip.ic_header,
-	    (mp->b_wptr - mp->b_rptr)
-	    - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
+	    MBLKL(mp) -
+	    (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
 		if (iv32 != (uint32_t)(key->wk_keyrsc >> 16)) {
 			/*
 			 * Previously cached Phase1 result was already lost, so
diff --git a/usr/src/uts/common/io/net80211/net80211_crypto_wep.c b/usr/src/uts/common/io/net80211/net80211_crypto_wep.c
index 5141a3c25a..c0a4faf5e3 100644
--- a/usr/src/uts/common/io/net80211/net80211_crypto_wep.c
+++ b/usr/src/uts/common/io/net80211/net80211_crypto_wep.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -45,6 +45,7 @@
 #include <sys/crypto/api.h>
 #include <sys/crc32.h>
 #include <sys/random.h>
+#include <sys/strsun.h>
 #include "net80211_impl.h"
 
 static  void *wep_attach(struct ieee80211com *, struct ieee80211_key *);
@@ -243,25 +244,25 @@ wep_encrypt(struct ieee80211_key *key, mblk_t *mp, int hdrlen)
 
 	(void) memcpy(rc4key, mp->b_rptr + hdrlen, IEEE80211_WEP_IVLEN);
 	(void) memcpy(rc4key + IEEE80211_WEP_IVLEN, key->wk_key,
-		key->wk_keylen);
+	    key->wk_keylen);
 
 	ctx = NULL;
 	rv = rc4_init(&ctx, (const uint8_t *)rc4key,
-		IEEE80211_WEP_IVLEN + key->wk_keylen);
+	    IEEE80211_WEP_IVLEN + key->wk_keylen);
 
 	if (rv != CRYPTO_SUCCESS)
 		return (0);
 
 	/* calculate CRC over unencrypted data */
 	CRC32(crc, mp->b_rptr + hdrlen + wep.ic_header,
-	    mp->b_wptr - mp->b_rptr - (hdrlen + wep.ic_header),
+	    MBLKL(mp) - (hdrlen + wep.ic_header),
 	    -1U, crc_table);
 
 	/* encrypt data */
 	(void) rc4_crypt(ctx,
-		mp->b_rptr + hdrlen + wep.ic_header,
-		mp->b_rptr + hdrlen + wep.ic_header,
-		mp->b_wptr - mp->b_rptr - (hdrlen + wep.ic_header));
+	    mp->b_rptr + hdrlen + wep.ic_header,
+	    mp->b_rptr + hdrlen + wep.ic_header,
+	    MBLKL(mp) - (hdrlen + wep.ic_header));
 
 	/* tack on ICV */
 	*(uint32_t *)crcbuf = LE_32(~crc);
@@ -290,25 +291,25 @@ wep_decrypt(struct ieee80211_key *key, mblk_t *mp, int hdrlen)
 
 	(void) memcpy(rc4key, mp->b_rptr + hdrlen, IEEE80211_WEP_IVLEN);
 	(void) memcpy(rc4key + IEEE80211_WEP_IVLEN, key->wk_key,
-		key->wk_keylen);
+	    key->wk_keylen);
 
 	ctx = NULL;
 	rv = rc4_init(&ctx, (const uint8_t *)rc4key,
-		IEEE80211_WEP_IVLEN + key->wk_keylen);
+	    IEEE80211_WEP_IVLEN + key->wk_keylen);
 
 	if (rv != CRYPTO_SUCCESS)
 		return (0);
 
 	/* decrypt data */
 	(void) rc4_crypt(ctx,
-		mp->b_rptr + hdrlen + wep.ic_header,
-		mp->b_rptr + hdrlen + wep.ic_header,
-		mp->b_wptr - mp->b_rptr -
-		(hdrlen + wep.ic_header + wep.ic_trailer));
+	    mp->b_rptr + hdrlen + wep.ic_header,
+	    mp->b_rptr + hdrlen + wep.ic_header,
+	    MBLKL(mp) -
+	    (hdrlen + wep.ic_header + wep.ic_trailer));
 
 	/* calculate CRC over unencrypted data */
 	CRC32(crc, mp->b_rptr + hdrlen + wep.ic_header,
-	    mp->b_wptr - mp->b_rptr -
+	    MBLKL(mp) -
 	    (hdrlen + wep.ic_header + wep.ic_trailer),
 	    -1U, crc_table);
 
diff --git a/usr/src/uts/common/io/net80211/net80211_input.c b/usr/src/uts/common/io/net80211/net80211_input.c
index 67f32e8680..737abcabc4 100644
--- a/usr/src/uts/common/io/net80211/net80211_input.c
+++ b/usr/src/uts/common/io/net80211/net80211_input.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -42,6 +42,7 @@
  */
 
 #include <sys/byteorder.h>
+#include <sys/strsun.h>
 #include "net80211_impl.h"
 
 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
@@ -74,10 +75,10 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 
 	ASSERT(in != NULL);
 	type = (uint8_t)-1;		/* undefined */
-	len = mp->b_wptr - mp->b_rptr;
+	len = MBLKL(mp);
 	if (len < sizeof (struct ieee80211_frame_min)) {
 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
-			"too short (1): len %u", len);
+		    "too short (1): len %u", len);
 		goto out;
 	}
 	/*
@@ -90,7 +91,7 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 	    IEEE80211_FC0_VERSION_0) {
 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
-			"discard pkt with wrong version %x", wh->i_fc[0]);
+		    "discard pkt with wrong version %x", wh->i_fc[0]);
 		goto out;
 	}
 
@@ -115,8 +116,8 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			} else {
 				if (len < sizeof (struct ieee80211_frame)) {
 					ieee80211_dbg(IEEE80211_MSG_ANY,
-						"ieee80211_input: too short(2):"
-						"len %u\n", len);
+					    "ieee80211_input: too short(2):"
+					    "len %u\n", len);
 					goto out_exit_mutex;
 				}
 				bssid = wh->i_addr3;
@@ -130,8 +131,8 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
 				/* not interested in */
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: not to bss %s\n",
-					ieee80211_macaddr_sprintf(bssid));
+				    "ieee80211_input: not to bss %s\n",
+				    ieee80211_macaddr_sprintf(bssid));
 				goto out_exit_mutex;
 			}
 			/*
@@ -146,7 +147,7 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				 * discovered member of the IBSS.
 				 */
 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
-					wh->i_addr2);
+				    wh->i_addr2);
 				if (in == NULL) {
 					/* NB: stat kept for alloc failure */
 					goto out_exit_mutex;
@@ -165,15 +166,15 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
 				/* duplicate, discard */
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: duplicate",
-					"seqno <%u,%u> fragno <%u,%u> tid %u",
-					rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
-					in->in_rxseqs[tid] >>
-						IEEE80211_SEQ_SEQ_SHIFT,
-					rxseq & IEEE80211_SEQ_FRAG_MASK,
-					in->in_rxseqs[tid] &
-						IEEE80211_SEQ_FRAG_MASK,
-					tid);
+				    "ieee80211_input: duplicate",
+				    "seqno <%u,%u> fragno <%u,%u> tid %u",
+				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
+				    in->in_rxseqs[tid] >>
+				    IEEE80211_SEQ_SEQ_SHIFT,
+				    rxseq & IEEE80211_SEQ_FRAG_MASK,
+				    in->in_rxseqs[tid] &
+				    IEEE80211_SEQ_FRAG_MASK,
+				    tid);
 				ic->ic_stats.is_rx_dups++;
 				goto out_exit_mutex;
 			}
@@ -187,15 +188,15 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 	case IEEE80211_FC0_TYPE_DATA:
 		if (len < hdrspace) {
 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
-				"data too short: expecting %u", hdrspace);
+			    "data too short: expecting %u", hdrspace);
 			goto out_exit_mutex;
 		}
 		switch (ic->ic_opmode) {
 		case IEEE80211_M_STA:
 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: data ",
-					"unknown dir 0x%x", dir);
+				    "ieee80211_input: data ",
+				    "unknown dir 0x%x", dir);
 				goto out_exit_mutex;
 			}
 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
@@ -207,7 +208,7 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				 * SIMPLEX interface.
 				 */
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: multicast echo\n");
+				    "ieee80211_input: multicast echo\n");
 				goto out_exit_mutex;
 			}
 			break;
@@ -215,15 +216,15 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		case IEEE80211_M_AHDEMO:
 			if (dir != IEEE80211_FC1_DIR_NODS) {
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: unknown dir 0x%x",
-					dir);
+				    "ieee80211_input: unknown dir 0x%x",
+				    dir);
 				goto out_exit_mutex;
 			}
 			break;
 		default:
 			ieee80211_err("ieee80211_input: "
-				"receive data, unknown opmode %u, skip\n",
-				ic->ic_opmode);
+			    "receive data, unknown opmode %u, skip\n",
+			    ic->ic_opmode);
 			goto out_exit_mutex;
 		}
 
@@ -236,7 +237,7 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				 * Discard encrypted frames when privacy off.
 				 */
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: ""WEP PRIVACY off");
+				    "ieee80211_input: ""WEP PRIVACY off");
 				ic->ic_stats.is_wep_errors++;
 				goto out_exit_mutex;
 			}
@@ -269,7 +270,7 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 */
 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
-				"data demic error\n");
+			    "data demic error\n");
 			goto out_exit_mutex;
 		}
 
@@ -291,9 +292,9 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				 * should be encrypted, discard all others.
 				 */
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: "
-					"%s WEP set but not permitted",
-					IEEE80211_SUBTYPE_NAME(subtype));
+				    "ieee80211_input: "
+				    "%s WEP set but not permitted",
+				    IEEE80211_SUBTYPE_NAME(subtype));
 				ic->ic_stats.is_wep_errors++;
 				goto out_exit_mutex;
 			}
@@ -302,8 +303,8 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				 * Discard encrypted frames when privacy off.
 				 */
 				ieee80211_dbg(IEEE80211_MSG_INPUT,
-					"ieee80211_input: "
-					"mgt WEP set but PRIVACY off");
+				    "ieee80211_input: "
+				    "mgt WEP set but PRIVACY off");
 				ic->ic_stats.is_wep_errors++;
 				goto out_exit_mutex;
 			}
@@ -322,7 +323,7 @@ ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 	case IEEE80211_FC0_TYPE_CTL:
 	default:
 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
-			"bad frame type 0x%x", type);
+		    "bad frame type 0x%x", type);
 		/* should not come here */
 		break;
 	}
@@ -454,11 +455,11 @@ ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
 			ieee80211_dbg(IEEE80211_MSG_XRATE,
-				"ieee80211_setup_rates: %s",
-				"[%s] extended rate set too large;"
-				" only using %u of %u rates\n",
-				ieee80211_macaddr_sprintf(in->in_macaddr),
-				nxrates, xrates[1]);
+			    "ieee80211_setup_rates: %s",
+			    "[%s] extended rate set too large;"
+			    " only using %u of %u rates\n",
+			    ieee80211_macaddr_sprintf(in->in_macaddr),
+			    nxrates, xrates[1]);
 		}
 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
 		rs->ir_nrates += nxrates;
@@ -477,7 +478,7 @@ ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
 	IEEE80211_LOCK_ASSERT(ic);
 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
 		ieee80211_dbg(IEEE80211_MSG_AUTH,
-			"open auth: bad sta auth mode %u", in->in_authmode);
+		    "open auth: bad sta auth mode %u", in->in_authmode);
 		return;
 	}
 	if (ic->ic_opmode == IEEE80211_M_STA) {
@@ -488,19 +489,19 @@ ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
 		IEEE80211_UNLOCK(ic);
 		if (status != 0) {
 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
-				"open auth failed (reason %d)\n", status);
+			    "open auth failed (reason %d)\n", status);
 			if (in != ic->ic_bss)
 				in->in_fails++;
 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
 		} else {
 			/* i_fc[0] - frame control's type & subtype field */
 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
-				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
 		}
 		IEEE80211_LOCK(ic);
 	} else {
 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
-			"bad operating mode %u", ic->ic_opmode);
+		    "bad operating mode %u", ic->ic_opmode);
 	}
 }
 
@@ -513,12 +514,12 @@ ieee80211_alloc_challenge(struct ieee80211_node *in)
 {
 	if (in->in_challenge == NULL) {
 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
-			KM_NOSLEEP);
+		    KM_NOSLEEP);
 	}
 	if (in->in_challenge == NULL) {
 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
-			"[%s] shared key challenge alloc failed\n",
-			ieee80211_macaddr_sprintf(in->in_macaddr));
+		    "[%s] shared key challenge alloc failed\n",
+		    ieee80211_macaddr_sprintf(in->in_macaddr));
 	}
 	return (in->in_challenge != NULL);
 }
@@ -543,7 +544,7 @@ ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
-			"bad sta auth mode %u", in->in_authmode);
+		    "bad sta auth mode %u", in->in_authmode);
 		goto bad;
 	}
 
@@ -555,10 +556,10 @@ ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
 		 * frm[1] - length
 		 * frm[2]... - challenge text
 		 */
-		if ((frm[1] + 2) > (efrm - frm)) {
+		if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) {
 			ieee80211_dbg(IEEE80211_MSG_AUTH,
-				"ieee80211_auth_shared: ie %d%d too long\n",
-				frm[0], (frm[1] + 2) - (efrm - frm));
+			    "ieee80211_auth_shared: ie %d%d too long\n",
+			    frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm)));
 			goto bad;
 		}
 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
@@ -570,13 +571,13 @@ ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
 	case IEEE80211_AUTH_SHARED_RESPONSE:
 		if (challenge == NULL) {
 			ieee80211_dbg(IEEE80211_MSG_AUTH,
-				"ieee80211_auth_shared: no challenge\n");
+			    "ieee80211_auth_shared: no challenge\n");
 			goto bad;
 		}
 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
 			ieee80211_dbg(IEEE80211_MSG_AUTH,
-				"ieee80211_auth_shared: bad challenge len %d\n",
-				challenge[1]);
+			    "ieee80211_auth_shared: bad challenge len %d\n",
+			    challenge[1]);
 			goto bad;
 		}
 	default:
@@ -595,16 +596,16 @@ ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
 			}
 			if (status != 0) {
 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
-					IEEE80211_MSG_AUTH,
-					"shared key auth failed (reason %d)\n",
-					status);
+				    IEEE80211_MSG_AUTH,
+				    "shared key auth failed (reason %d)\n",
+				    status);
 				if (in != ic->ic_bss)
 					in->in_fails++;
 				return;
 			}
 			IEEE80211_UNLOCK(ic);
 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
-				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
 			IEEE80211_LOCK(ic);
 			break;
 		case IEEE80211_AUTH_SHARED_CHALLENGE:
@@ -613,20 +614,20 @@ ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
 			IEEE80211_UNLOCK(ic);
 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
-				seq + 1);
+			    seq + 1);
 			IEEE80211_LOCK(ic);
 			break;
 		default:
 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
-				"shared key auth: bad seq %d", seq);
+			    "shared key auth: bad seq %d", seq);
 			return;
 		}
 		break;
 
 	default:
 		ieee80211_dbg(IEEE80211_MSG_AUTH,
-			"ieee80211_auth_shared: bad opmode %u\n",
-			ic->ic_opmode);
+		    "ieee80211_auth_shared: bad opmode %u\n",
+		    ic->ic_opmode);
 		break;
 	}
 	return;
@@ -700,7 +701,8 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 	 *	[tlv] WME
 	 *	[tlv] WPA or RSN
 	 */
-	IEEE80211_VERIFY_LENGTH(efrm - frm, IEEE80211_BEACON_ELEM_MIN, return);
+	IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
+	    IEEE80211_BEACON_ELEM_MIN, return);
 	bzero(&scan, sizeof (scan));
 	scan.tstamp  = frm;
 	frm += 8;
@@ -719,7 +721,7 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			break;
 		}
 
-		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return);
+		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return);
 		switch (*frm) {
 		case IEEE80211_ELEMID_SSID:
 			scan.ssid = frm;
@@ -746,7 +748,7 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			break;
 		case IEEE80211_ELEMID_TIM:
 			scan.tim = frm;
-			scan.timoff = frm - mp->b_rptr;
+			scan.timoff = _PTRDIFF(frm, mp->b_rptr);
 			break;
 		case IEEE80211_ELEMID_IBSSPARMS:
 			break;
@@ -756,11 +758,11 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		case IEEE80211_ELEMID_ERP:
 			if (frm[1] != 1) {
 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
-					"ieee80211_recv_mgmt: ignore %s, "
-					"invalid ERP element; "
-					"length %u, expecting 1\n",
-					IEEE80211_SUBTYPE_NAME(subtype),
-					frm[1]);
+				    "ieee80211_recv_mgmt: ignore %s, "
+				    "invalid ERP element; "
+				    "length %u, expecting 1\n",
+				    IEEE80211_SUBTYPE_NAME(subtype),
+				    frm[1]);
 				break;
 			}
 			scan.erp = frm[2];
@@ -775,11 +777,11 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			break;
 		default:
 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
-				"ieee80211_recv_mgmt: ignore %s,"
-				"unhandled id %u, len %u, totallen %u",
-				IEEE80211_SUBTYPE_NAME(subtype),
-				*frm, frm[1],
-				mp->b_wptr - mp->b_rptr);
+			    "ieee80211_recv_mgmt: ignore %s,"
+			    "unhandled id %u, len %u, totallen %u",
+			    IEEE80211_SUBTYPE_NAME(subtype),
+			    *frm, frm[1],
+			    MBLKL(mp));
 			break;
 		}
 		/* frm[1] - component length */
@@ -789,9 +791,9 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
-			"ieee80211_recv_mgmt: ignore %s ,"
-			"invalid channel %u\n",
-			IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
+		    "ieee80211_recv_mgmt: ignore %s ,"
+		    "invalid channel %u\n",
+		    IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
 		return;
 	}
 	if (scan.chan != scan.bchan &&
@@ -807,18 +809,18 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 *	different hop pattern in FH.
 		 */
 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
-			"ieee80211_recv_mgmt: ignore %s ,"
-			"phytype %u channel %u marked for %u\n",
-			IEEE80211_SUBTYPE_NAME(subtype),
-			ic->ic_phytype, scan.bchan, scan.chan);
+		    "ieee80211_recv_mgmt: ignore %s ,"
+		    "phytype %u channel %u marked for %u\n",
+		    IEEE80211_SUBTYPE_NAME(subtype),
+		    ic->ic_phytype, scan.bchan, scan.chan);
 		return;
 	}
 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
-			"ieee80211_recv_mgmt: ignore %s ,"
-			"bogus beacon interval %u\n",
-			IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
+		    "ieee80211_recv_mgmt: ignore %s ,"
+		    "bogus beacon interval %u\n",
+		    IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
 		return;
 	}
 
@@ -841,18 +843,18 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		if ((in->in_capinfo ^ scan.capinfo) &
 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
-				"ieee80211_recv_mgmt: "
-				"[%s] cap change: before 0x%x, now 0x%x\n",
-				ieee80211_macaddr_sprintf(wh->i_addr2),
-				in->in_capinfo, scan.capinfo);
+			    "ieee80211_recv_mgmt: "
+			    "[%s] cap change: before 0x%x, now 0x%x\n",
+			    ieee80211_macaddr_sprintf(wh->i_addr2),
+			    in->in_capinfo, scan.capinfo);
 			/*
 			 * NB:	we assume short preamble doesn't
 			 *	change dynamically
 			 */
 			ieee80211_set_shortslottime(ic,
-				ic->ic_curmode == IEEE80211_MODE_11A ||
-					(scan.capinfo &
-					IEEE80211_CAPINFO_SHORT_SLOTTIME));
+			    ic->ic_curmode == IEEE80211_MODE_11A ||
+			    (scan.capinfo &
+			    IEEE80211_CAPINFO_SHORT_SLOTTIME));
 			in->in_capinfo = scan.capinfo;
 		}
 
@@ -865,7 +867,7 @@ ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		}
 		if (ic->ic_flags & IEEE80211_F_SCAN) {
 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
-				rstamp);
+			    rstamp);
 		}
 		return;
 	}
@@ -951,7 +953,8 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 */
 		ssid = rates = xrates = NULL;
 		while (frm < efrm) {
-			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], goto out);
+			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
+			    frm[1], goto out);
 			switch (*frm) {
 			case IEEE80211_ELEMID_SSID:
 				ssid = frm;
@@ -970,9 +973,9 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
 			ieee80211_dbg(IEEE80211_MSG_INPUT,
-				"ieee80211_recv_mgmt: ignore %s, "
-				"no ssid with ssid suppression enabled",
-				IEEE80211_SUBTYPE_NAME(subtype));
+			    "ieee80211_recv_mgmt: ignore %s, "
+			    "no ssid with ssid suppression enabled",
+			    IEEE80211_SUBTYPE_NAME(subtype));
 			break;
 		}
 
@@ -989,14 +992,14 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				 * neighbor table.
 				 */
 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
-					wh->i_addr2);
+				    wh->i_addr2);
 			}
 			if (in == NULL)
 				break;
 		}
 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
-			"[%s] recv probe req\n",
-			ieee80211_macaddr_sprintf(wh->i_addr2));
+		    "[%s] recv probe req\n",
+		    ieee80211_macaddr_sprintf(wh->i_addr2));
 		in->in_rssi = (uint8_t)rssi;
 		in->in_rstamp = rstamp;
 		/*
@@ -1006,16 +1009,16 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 * supported by both station and the device
 		 */
 		rate = ieee80211_setup_rates(in, rates, xrates,
-			IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
-			IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
+		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
+		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 		if (rate & IEEE80211_RATE_BASIC) {
 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
-				"%s recv'd rate set invalid",
-				IEEE80211_SUBTYPE_NAME(subtype));
+			    "%s recv'd rate set invalid",
+			    IEEE80211_SUBTYPE_NAME(subtype));
 		} else {
 			IEEE80211_UNLOCK(ic);
 			IEEE80211_SEND_MGMT(ic, in,
-				IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
+			    IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
 			IEEE80211_LOCK(ic);
 		}
 		if (allocbs) {
@@ -1035,32 +1038,32 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 *	[2] status
 		 *	[tlv*] challenge
 		 */
-		IEEE80211_VERIFY_LENGTH(efrm - frm, IEEE80211_AUTH_ELEM_MIN,
-			break);
+		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
+		    IEEE80211_AUTH_ELEM_MIN, break);
 		algo   = (*(uint16_t *)frm);
 		seq    = (*(uint16_t *)(frm + 2));
 		status = (*(uint16_t *)(frm + 4));
 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
-			"[%s] recv auth frame with algorithm %d seq %d\n",
-			ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
+		    "[%s] recv auth frame with algorithm %d seq %d\n",
+		    ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
 
 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
-				"ieee80211_recv_mgmt: ignore auth, %s\n",
-				"TKIP countermeasures enabled");
+			    "ieee80211_recv_mgmt: ignore auth, %s\n",
+			    "TKIP countermeasures enabled");
 			break;
 		}
 		switch (algo) {
 		case IEEE80211_AUTH_ALG_SHARED:
 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
-				seq, status);
+			    seq, status);
 			break;
 		case IEEE80211_AUTH_ALG_OPEN:
 			ieee80211_auth_open(ic, wh, in, seq, status);
 			break;
 		default:
 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
-				"ignore auth, unsupported alg %d", algo);
+			    "ignore auth, unsupported alg %d", algo);
 			break;
 		}
 		break;
@@ -1080,8 +1083,8 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 *	[tlv] extended supported rates
 		 *	[tlv] WME
 		 */
-		IEEE80211_VERIFY_LENGTH(efrm - frm,
-			IEEE80211_ASSOC_RESP_ELEM_MIN, break);
+		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
+		    IEEE80211_ASSOC_RESP_ELEM_MIN, break);
 		in = ic->ic_bss;
 		capinfo = (*(uint16_t *)frm);
 		frm += 2;
@@ -1089,7 +1092,7 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		frm += 2;
 		if (status != 0) {
 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
-				"assoc failed (reason %d)\n", status);
+			    "assoc failed (reason %d)\n", status);
 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
 			if (in != NULL) {
 				in->in_fails++;
@@ -1115,7 +1118,8 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 				break;
 			}
 
-			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], goto out);
+			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
+			    frm[1], goto out);
 			switch (*frm) {
 			case IEEE80211_ELEMID_RATES:
 				rates = frm;
@@ -1135,11 +1139,11 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 * either AP or the device.
 		 */
 		rate = ieee80211_setup_rates(in, rates, xrates,
-			IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
-			IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
+		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
+		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 		if (rate & IEEE80211_RATE_BASIC) {
 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
-				"assoc failed (rate set mismatch)\n");
+			    "assoc failed (rate set mismatch)\n");
 			if (in != ic->ic_bss)
 				in->in_fails++;
 			IEEE80211_UNLOCK(ic);
@@ -1162,8 +1166,8 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 			ic->ic_flags |= IEEE80211_F_USEBARKER;
 		}
 		ieee80211_set_shortslottime(ic,
-			ic->ic_curmode == IEEE80211_MODE_11A ||
-			(in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
+		    ic->ic_curmode == IEEE80211_MODE_11A ||
+		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 		/*
 		 * Honor ERP protection.
 		 *
@@ -1176,11 +1180,11 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		else
 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
-			"assoc success: %s preamble, %s slot time%s%s\n",
-			ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
-			ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
-			ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
-			in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
+		    "assoc success: %s preamble, %s slot time%s%s\n",
+		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
+		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
+		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
+		    in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
 		IEEE80211_UNLOCK(ic);
 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
 		return;
@@ -1193,16 +1197,16 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 * deauth frame format
 		 *	[2] reason
 		 */
-		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, break);
+		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
 		status = (*(uint16_t *)frm);
 
 		ieee80211_dbg(IEEE80211_MSG_AUTH,
-			"recv deauthenticate (reason %d)\n", status);
+		    "recv deauthenticate (reason %d)\n", status);
 		switch (ic->ic_opmode) {
 		case IEEE80211_M_STA:
 			IEEE80211_UNLOCK(ic);
 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
-				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
 			return;
 		default:
 			break;
@@ -1218,16 +1222,16 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 		 * disassoc frame format
 		 *	[2] reason
 		 */
-		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, break);
+		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
 		status = (*(uint16_t *)frm);
 
 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
-			"recv disassociate (reason %d)\n", status);
+		    "recv disassociate (reason %d)\n", status);
 		switch (ic->ic_opmode) {
 		case IEEE80211_M_STA:
 			IEEE80211_UNLOCK(ic);
 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
-				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
 			return;
 		default:
 			break;
@@ -1236,7 +1240,7 @@ ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
 
 	default:
 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
-			"subtype 0x%x not handled\n", subtype);
+		    "subtype 0x%x not handled\n", subtype);
 		break;
 	} /* switch subtype */
 out:
diff --git a/usr/src/uts/common/io/net80211/net80211_output.c b/usr/src/uts/common/io/net80211/net80211_output.c
index 0a3ab5647f..abd42cfdb5 100644
--- a/usr/src/uts/common/io/net80211/net80211_output.c
+++ b/usr/src/uts/common/io/net80211/net80211_output.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -711,7 +711,7 @@ ieee80211_beacon_alloc(ieee80211com_t *ic, ieee80211_node_t *in,
 		frm = ieee80211_add_erp(frm, ic);
 	}
 	efrm = ieee80211_add_xrates(frm, rs);
-	bo->bo_trailer_len = efrm - bo->bo_trailer;
+	bo->bo_trailer_len = _PTRDIFF(efrm, bo->bo_trailer);
 	m->b_wptr = efrm;
 
 	wh = (struct ieee80211_frame *)m->b_rptr;
diff --git a/usr/src/uts/common/io/pcan/pcan.c b/usr/src/uts/common/io/pcan/pcan.c
index 7c57a373c1..83e9fca5b3 100644
--- a/usr/src/uts/common/io/pcan/pcan.c
+++ b/usr/src/uts/common/io/pcan/pcan.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -1011,7 +1011,7 @@ pcan_send(pcan_maci_t *pcan_p, mblk_t *mblk_p)
 #ifdef DEBUG
 	if (pcan_debug & PCAN_DBG_SEND) {
 		cmn_err(CE_NOTE, "pcan send: packet from plugin");
-		for (i = 0; i < mblk_p->b_wptr - mblk_p->b_rptr; i++)
+		for (i = 0; i < MBLKL(mblk_p); i++)
 			cmn_err(CE_NOTE, "%x: %x\n", i,
 			    *((unsigned char *)mblk_p->b_rptr + i));
 	}
@@ -1127,7 +1127,7 @@ pcian_send(pcan_maci_t *pcan_p, mblk_t *mblk_p)
 #ifdef DEBUG
 	if (pcan_debug & PCAN_DBG_SEND) {
 		cmn_err(CE_NOTE, "pcan(pci) send: packet from plugin");
-		for (i = 0; i < mblk_p->b_wptr - mblk_p->b_rptr; i++)
+		for (i = 0; i < MBLKL(mblk_p); i++)
 			cmn_err(CE_NOTE, "%x: %x\n", i,
 			    *((unsigned char *)mblk_p->b_rptr + i));
 	}
diff --git a/usr/src/uts/common/io/ral/rt2560.c b/usr/src/uts/common/io/ral/rt2560.c
index dd699799bc..d73f3561dc 100644
--- a/usr/src/uts/common/io/ral/rt2560.c
+++ b/usr/src/uts/common/io/ral/rt2560.c
@@ -1287,6 +1287,7 @@ skip:		desc->flags = LE_32(RT2560_RX_BUSY);
 uint_t
 ral_softint_handler(caddr_t data)
 {
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
 	struct rt2560_softc *sc = (struct rt2560_softc *)data;
 
 	/*
@@ -1297,7 +1298,7 @@ ral_softint_handler(caddr_t data)
 	if (sc->sc_rx_pend) {
 		sc->sc_rx_pend = 0;
 		RAL_UNLOCK(sc);
-		rt2560_rx_intr((struct rt2560_softc *)data);
+		rt2560_rx_intr(sc);
 		return (DDI_INTR_CLAIMED);
 	}
 	RAL_UNLOCK(sc);
@@ -1513,6 +1514,7 @@ rt2560_mgmt_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
 
 		dur = rt2560_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
 		    RAL_SIFS;
+		/* LINTED E_BAD_PTR_CAST_ALIGN */
 		*(uint16_t *)wh->i_dur = LE_16(dur);
 
 		/* tell hardware to add timestamp for probe responses */
@@ -1672,6 +1674,7 @@ rt2560_send(ieee80211com_t *ic, mblk_t *mp)
 
 		dur = rt2560_txtime(RAL_ACK_SIZE, rt2560_ack_rate(ic, rate),
 		    ic->ic_flags) + RAL_SIFS;
+		/* LINTED E_BAD_PTR_CAST_ALIGN */
 		*(uint16_t *)wh->i_dur = LE_16(dur);
 	}
 
@@ -2207,6 +2210,7 @@ rt2560_m_stat(void *arg, uint_t stat, uint64_t *val)
 static uint_t
 rt2560_intr(caddr_t arg)
 {
+	/* LINTED E_BAD_PTR_CAST_ALIGN */
 	struct rt2560_softc *sc = (struct rt2560_softc *)arg;
 	uint32_t r;
 
@@ -2328,8 +2332,10 @@ rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
 		cachelsz = 0x10;
 	sc->sc_cachelsz = cachelsz << 2;
 
-	vendor_id = ddi_get16(ioh, (uint16_t *)(regs + PCI_CONF_VENID));
-	device_id = ddi_get16(ioh, (uint16_t *)(regs + PCI_CONF_DEVID));
+	vendor_id = ddi_get16(ioh,
+	    (uint16_t *)((uintptr_t)regs + PCI_CONF_VENID));
+	device_id = ddi_get16(ioh,
+	    (uint16_t *)((uintptr_t)regs + PCI_CONF_DEVID));
 
 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): vendor 0x%x, "
 	    "device id 0x%x, cache size %d\n", vendor_id, device_id, cachelsz);
@@ -2339,7 +2345,7 @@ rt2560_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
 	 * and enabe bus master.
 	 */
 	command = PCI_COMM_MAE | PCI_COMM_ME;
-	ddi_put16(ioh, (uint16_t *)(regs + PCI_CONF_COMM), command);
+	ddi_put16(ioh, (uint16_t *)((uintptr_t)regs + PCI_CONF_COMM), command);
 	RAL_DEBUG(RAL_DBG_GLD, "ral: rt2560_attach(): "
 	    "set command reg to 0x%x \n", command);
 
diff --git a/usr/src/uts/common/io/ral/rt2560_reg.h b/usr/src/uts/common/io/ral/rt2560_reg.h
index ee5628840e..ff7299138f 100644
--- a/usr/src/uts/common/io/ral/rt2560_reg.h
+++ b/usr/src/uts/common/io/ral/rt2560_reg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -322,10 +322,11 @@ struct rt2560_rx_desc {
  * control and status registers access macros
  */
 #define	RAL_READ(sc, reg)						\
-	ddi_get32((sc)->sc_ioh, (uint32_t *)((sc)->sc_rbase + (reg)))
+	ddi_get32((sc)->sc_ioh, (uint32_t *)((uintptr_t)(sc)->sc_rbase + (reg)))
 
 #define	RAL_WRITE(sc, reg, val)						\
-	ddi_put32((sc)->sc_ioh, (uint32_t *)((sc)->sc_rbase + (reg)), (val))
+	ddi_put32((sc)->sc_ioh,						\
+	    (uint32_t *)((uintptr_t)(sc)->sc_rbase + (reg)), (val))
 
 
 /*
diff --git a/usr/src/uts/intel/ath/Makefile b/usr/src/uts/intel/ath/Makefile
index b78644a4d3..d495572707 100644
--- a/usr/src/uts/intel/ath/Makefile
+++ b/usr/src/uts/intel/ath/Makefile
@@ -65,14 +65,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 LDFLAGS		+= -dy -Nmisc/mac -Nmisc/net80211
 
 #
-# For now, disable these lint checks; maintainers should endeavor
-# to investigate and remove these for maximum lint coverage.
-# Please do not carry these forward to new Makefiles.
-#
-LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
-LINTTAGS	+= -erroff=E_ASSIGN_NARROW_CONV
-
-#
 #	Default build targets.
 #
 .KEEP_STATE:
diff --git a/usr/src/uts/intel/iwk/Makefile b/usr/src/uts/intel/iwk/Makefile
index ba2aec3a81..e3654b1bab 100644
--- a/usr/src/uts/intel/iwk/Makefile
+++ b/usr/src/uts/intel/iwk/Makefile
@@ -59,7 +59,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #	Overrides
 #
 LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
-LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
 
 CPPFLAGS	+= -I. -D_KERNEL -DIWL=4965
 
diff --git a/usr/src/uts/intel/net80211/Makefile b/usr/src/uts/intel/net80211/Makefile
index 3365320fe7..61dfa1a27c 100644
--- a/usr/src/uts/intel/net80211/Makefile
+++ b/usr/src/uts/intel/net80211/Makefile
@@ -20,7 +20,7 @@
 #
 
 #
-# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 
@@ -66,7 +66,6 @@ LDFLAGS		+= -dy -Nmisc/mac -Nmac/mac_wifi -Ndrv/ip
 # STREAMS API limitations force us to turn off these lint checks.
 #
 LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
-LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
 
 #
 #	Default build targets.
diff --git a/usr/src/uts/intel/pcan/Makefile b/usr/src/uts/intel/pcan/Makefile
index 93e9918f1a..9d4fccb38f 100644
--- a/usr/src/uts/intel/pcan/Makefile
+++ b/usr/src/uts/intel/pcan/Makefile
@@ -20,7 +20,7 @@
 #
 
 #
-# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 # ident	"%Z%%M%	%I%	%E% SMI"
@@ -72,7 +72,6 @@ CFLAGS          += -v
 # STREAMS API limitations force us to turn off these lint checks.
 #
 LINTTAGS        += -erroff=E_BAD_PTR_CAST_ALIGN
-LINTTAGS        += -erroff=E_PTRDIFF_OVERFLOW
 
 #
 # dependency
diff --git a/usr/src/uts/intel/ral/Makefile b/usr/src/uts/intel/ral/Makefile
index 3f9b31dcb3..50458e4d39 100644
--- a/usr/src/uts/intel/ral/Makefile
+++ b/usr/src/uts/intel/ral/Makefile
@@ -19,7 +19,7 @@
 # CDDL HEADER END
 #
 #
-# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 
@@ -60,9 +60,6 @@ INSTALL_TARGET	= $(BINARY) $(ROOTMODULE)
 #
 LDFLAGS		+= -dy -Nmisc/mac -Nmisc/net80211
 
-LINTTAGS	+= -erroff=E_BAD_PTR_CAST_ALIGN
-LINTTAGS	+= -erroff=E_PTRDIFF_OVERFLOW
-
 #
 #	Default build targets.
 #