Yeah, that's it! Now for the relavent bits:

XS(XS_Net__LibnetRaw_libnet_do_checksum)
[...]
        u_char  buf = (u_char)SvUV(ST(0));
[...]
        RETVAL = libnet_do_checksum(&buf, protocol, len);
        sv_setuv(ST(0), (UV)buf);
        SvSETMAGIC(ST(0));
[download]

The above is exactly what you want. You need to make the other functions handle buf the same way this one does. You also got it correct for Net__LibnetRaw_libnet_build_ip and Net__LibnetRaw_libnet_build_tcp.

XS(XS_Net__LibnetRaw_libnet_destroy_packet)
[...]
        u_char *        buf = (u_char *)SvPV(ST(0),PL_na);
        RETVAL = libnet_destroy_packet(&buf);
[download]

You want to add some code here that destroys the buf object. Probably just:

    OUTPUT:
        buf    sv_setsv(ST(0),&PL_sv_undef);
[download]

Now for the source of your problem (I think):

XS(XS_Net__LibnetRaw_libnet_init_packet)
[...]
        u_char *        buf = (u_char *)SvPV(ST(1),PL_na);
[...]
        RETVAL = libnet_init_packet(p_size, &buf);
        sv_setpv((SV*)ST(1), buf);
[download]

This function seems to have used a different typemap for buf which is trying to extract the '\0'-terminated string that it is supposed to point to. I think all you need to do is fix this typemap to be like the other functions.

I'm going to check some other things I noticed and I'll reply separately if I detect any problems.

        - tye (but my friends call me "Tye")