Of course, on the alloc path, it seems to add an additional "NV_RX_ALLOC_PAD" thing, so maybe the "end-data" thing makes sense.The problem is the pci_unmap_single() call that happens during nv_close() or the rx interrupt handler. I think it makes more sense to rely on fields in the individual skb instead of reading from np->rx_buf_sz. If np->rx_buf_sz changes inbetween, then we have a memory leak.