bpf_movein is only called from bpfwrite, which has process context
so you can reliably sleep waiting for memory. so use M_WAIT instead
of M_NOWAIT to get the tag.

also, if you do fail you probably dont want to leak the mbuf and
cluster you just allocated. if we cant fail we cant leak.

ok?

Index: bpf.c
===================================================================
RCS file: /cvs/src/sys/net/bpf.c,v
retrieving revision 1.103
diff -u -p -r1.103 bpf.c
--- bpf.c	12 Jul 2014 18:44:22 -0000	1.103
+++ bpf.c	18 Sep 2014 11:48:32 -0000
@@ -224,9 +224,7 @@ bpf_movein(struct uio *uio, u_int linkty
 	/*
 	 * Prepend the data link type as a mbuf tag
 	 */
-	mtag = m_tag_get(PACKET_TAG_DLT, sizeof(u_int), M_NOWAIT);
-	if (mtag == NULL)
-		return (ENOMEM);
+	mtag = m_tag_get(PACKET_TAG_DLT, sizeof(u_int), M_WAIT);
 	*(u_int *)(mtag + 1) = linktype;
 	m_tag_prepend(m, mtag);