MFC r282594:

m_dup() is supposed to give a writable copy of an mbuf chain. It uses
  m_dup_pkthdr(), that uses M_COPYFLAGS mask to copy m_flags field.
  If original mbuf chain has M_RDONLY flag, its copy also will have it.
  Reset this flag explicitly.

sys/kern/uipc_mbuf.c

@@ -934,6 +934,7 @@ m_dup(struct mbuf *m, int how)
 			}
 			if ((n->m_flags & M_EXT) == 0)
 				nsize = MHLEN;
+			n->m_flags &= ~M_RDONLY;
 		}
 		n->m_len = 0;