Index: sys/kern/uipc_socket.c
===================================================================
--- sys/kern/uipc_socket.c	(revision 225368)
+++ sys/kern/uipc_socket.c	(working copy)
@@ -2030,7 +2030,11 @@ deliver:
 	if (mp0 != NULL) {
 		/* Dequeue as many mbufs as possible. */
 		if (!(flags & MSG_PEEK) && len >= sb->sb_mb->m_len) {
-			for (*mp0 = m = sb->sb_mb;
+			if (*mp0 == NULL)
+				*mp0 = sb->sb_mb;
+			else
+				n->m_next = sb->sb_mb;
+			for (m = sb->sb_mb;
 			     m != NULL && m->m_len <= len;
 			     m = m->m_next) {
 				len -= m->m_len;
@@ -2052,7 +2056,7 @@ deliver:
 			if (m == NULL)
 				len = 0;	/* Don't flush data from sockbuf. */
 			else
-				uio->uio_resid -= m->m_len;
+				uio->uio_resid -= len;
 			if (*mp0 != NULL)
 				n->m_next = m;
 			else
@@ -2061,6 +2065,9 @@ deliver:
 				error = ENOBUFS;
 				goto out;
 			}
+			/* Update n to point to the last mbuf. */
+			for (; m != NULL; m = m->m_next)
+				n = m;
 		}
 	} else {
 		/* NB: Must unlock socket buffer as uiomove may sleep. */