@@ -6,7 +6,8 @@
 from pythonbpf.helper import HelperHandlerRegistry
 from pythonbpf.vmlinux_parser.dependency_node import Field
 from .expr import VmlinuxHandlerRegistry
-from pythonbpf.type_deducer import ctypes_to_ir, IntTy, signedness
+from pythonbpf.type_deducer import ctypes_to_ir, IntTy, signedness, PktPtrTy
+from pythonbpf.expr.packet_pointer import packet_type
 from pythonbpf.expr.type_inference import infer_int_type
 from pythonbpf.maps import BPFMapType
 
@@ -299,7 +300,10 @@ def _allocate_for_binop(builder, var_name, rval, local_sym_tab, compilation_cont
     inferred = infer_int_type(rval, local_sym_tab, compilation_context)
     if inferred is None:
         logger.debug(f"Could not infer a type for {var_name}, assuming signed i64")
-    ir_type = IntTy(64, signedness(inferred) if inferred is not None else True)
+    if isinstance(inferred, PktPtrTy):
+        ir_type = inferred  # data + 14 is still a packet pointer
+    else:
+        ir_type = IntTy(64, signedness(inferred) if inferred is not None else True)
     var = builder.alloca(ir_type, name=var_name)
     var.align = 8
     local_sym_tab[var_name] = LocalSymbol(var, ir_type)
@@ -399,6 +403,13 @@ def _allocate_for_attribute(
             # Same discriminator handle_vmlinux_struct_field uses: a context
             # argument has no alloca of its own.
             is_context_field = local_sym_tab[struct_var].var is None
+            pkt_ty = packet_type(rval, local_sym_tab)
+            if pkt_ty is not None:
+                # A packet-pointer field: a 64-bit slot that carries the kind.
+                var = _allocate_with_type(builder, var_name, pkt_ty)
+                local_sym_tab[var_name] = LocalSymbol(var, pkt_ty)
+                logger.info(f"Pre-allocated {var_name} as {pkt_ty.describe()}")
+                return
             if not VmlinuxHandlerRegistry.has_field(vmlinux_struct_name, field_name):
                 logger.error(
                     f"Field '{field_name}' not found in vmlinux struct '{vmlinux_struct_name}'"
 
@@ -9,6 +9,7 @@
     field_int_type,
     is_ctypes,
     IntTy,
+    PktPtrTy,
     int_literal_type,
     signedness,
 )
@@ -24,7 +25,7 @@
     get_base_type_and_depth,
 )
 from .vmlinux_registry import VmlinuxHandlerRegistry
-from .packet_pointer import MAX_PACKET_OFF, is_packet_pointer
+from .packet_pointer import MAX_PACKET_OFF, packet_type
 from ..vmlinux_parser.dependency_node import Field
 
 logger: Logger = logging.getLogger(__name__)
@@ -123,6 +124,11 @@ def _handle_attribute_expr(
                     expr, local_sym_tab, None, builder
                 )
                 if vmlinux_result is not None:
+                    pkt_ty = packet_type(expr, local_sym_tab)
+                    if pkt_ty is not None:
+                        # A packet-pointer field: the value is the loaded
+                        # pointer, and the descriptor says so from here on.
+                        return vmlinux_result[0], pkt_ty
                     return vmlinux_result
                 else:
                     raise RuntimeError("Vmlinux struct did not process successfully")
@@ -200,6 +206,8 @@ def _descriptor(val, ty):
     value unless the descriptor is itself an integer type, sign from the
     descriptor (an IntTy, a vmlinux Field, or plain -> signed). None when the
     value is not an integer at all."""
+    if isinstance(ty, PktPtrTy):
+        return ty  # a packet pointer keeps its kind, never re-ranked
     if isinstance(ty, ir.IntType):
         return IntTy(ty.width, signedness(ty))
     field = field_int_type(ty)
@@ -285,18 +293,16 @@ def _handle_binary_op_impl(func, compilation_context, rval, builder, local_sym_t
     narrowed to it -- so u32 * u32 wraps at 32 bits even though the arithmetic
     itself runs in an i64 register. Returns (value, IntTy)."""
     op = rval.op
-    left_pkt = is_packet_pointer(rval.left, local_sym_tab)
-    right_pkt = is_packet_pointer(rval.right, local_sym_tab)
     left, left_ty = get_typed_operand(
         func, compilation_context, rval.left, builder, local_sym_tab
     )
     right, right_ty = get_typed_operand(
         func, compilation_context, rval.right, builder, local_sym_tab
     )
-    if left_pkt or right_pkt:
-        return _packet_pointer_binop(
-            builder, rval, left, left_ty, left_pkt, right, right_ty, right_pkt
-        )
+    if isinstance(left_ty, PktPtrTy) or isinstance(right_ty, PktPtrTy):
+        # Before the usual arithmetic conversions, which would re-rank the
+        # pointer as an ordinary integer and drop its kind.
+        return _packet_pointer_binop(builder, rval, left, left_ty, right, right_ty)
     result_ty = usual_arithmetic_conversions(left_ty, right_ty)
     logger.info(
         f"binop {type(op).__name__}: {left_ty.describe()} x {right_ty.describe()} "
@@ -308,21 +314,20 @@ def _handle_binary_op_impl(func, compilation_context, rval, builder, local_sym_t
     return canonicalise(builder, result, result_ty), result_ty
 
 
-def _packet_pointer_binop(
-    builder, rval, left, left_ty, left_pkt, right, right_ty, right_pkt
-):
+def _packet_pointer_binop(builder, rval, left, left_ty, right, right_ty):
     """A binary operation with a packet-pointer operand (see packet_pointer.py):
-    64-bit, never ranked as the field's declared u32, with the offset taken as
-    an unsigned 16-bit value so the verifier can track the packet range."""
+    64-bit, never ranked as an ordinary integer, with the offset taken as an
+    unsigned 16-bit value so the verifier can track the packet range. The
+    result of pointer +/- offset is a pointer of the same kind; pointer -
+    pointer is a plain 64-bit length."""
     op = rval.op
     where = f"line {rval.lineno}: {ast.unparse(rval)}"
-    ptr_ty = IntTy(64, False)
+    left_pkt = isinstance(left_ty, PktPtrTy)
+    right_pkt = isinstance(right_ty, PktPtrTy)
     if left_pkt and right_pkt:
         if isinstance(op, ast.Sub):
             # data_end - data: a length, an ordinary 64-bit scalar.
-            left = convert(builder, left, left_ty, ptr_ty)
-            right = convert(builder, right, right_ty, ptr_ty)
-            return builder.sub(left, right), ptr_ty
+            return builder.sub(left, right), IntTy(64, False)
         raise SyntaxError(
             f"only subtraction is defined between packet pointers ({where})"
         )
@@ -333,24 +338,24 @@ def _packet_pointer_binop(
     if right_pkt and isinstance(op, ast.Sub):
         raise SyntaxError(f"cannot subtract a packet pointer from an offset ({where})")
 
-    ptr, ptr_src_ty, off, off_ty = (
-        (left, left_ty, right, right_ty)
-        if left_pkt
-        else (right, right_ty, left, left_ty)
-    )
+    ptr, ptr_ty, off = (left, left_ty, right) if left_pkt else (right, right_ty, left)
+    if ptr_ty.kind == "pkt_end":
+        # The verifier only compares against the end of the packet.
+        raise SyntaxError(
+            f"a packet-end pointer can only be compared, not offset ({where})"
+        )
     if isinstance(off, ir.Constant) and isinstance(off.constant, int):
         if not 0 <= off.constant <= MAX_PACKET_OFF:
             raise SyntaxError(
                 f"packet offset {off.constant} is outside 0..{MAX_PACKET_OFF} "
                 f"({where}); subtract instead of adding a negative offset"
             )
-    ptr = convert(builder, ptr, ptr_src_ty, ptr_ty)
     # The offset as u16, widened with zero-extension: a value the verifier can
     # bound to [0, 0xffff].
     off = builder.trunc(off, ir.IntType(16)) if off.type.width > 16 else off
     off = builder.zext(off, ir.IntType(64)) if off.type.width < 64 else off
     result = builder.add(ptr, off) if isinstance(op, ast.Add) else builder.sub(ptr, off)
-    return result, ptr_ty
+    return result, PktPtrTy(ptr_ty.kind)
 
 
 def _handle_binary_op(
@@ -462,6 +467,13 @@ def _handle_compare(func, compilation_context, builder, cond, local_sym_tab):
     lhs, lhs_ty = lhs
     rhs, rhs_ty = rhs
     lhs_desc, rhs_desc = _descriptor(lhs, lhs_ty), _descriptor(rhs, rhs_ty)
+    if isinstance(lhs_desc, PktPtrTy) or isinstance(rhs_desc, PktPtrTy):
+        # A packet bounds check (data + n > data_end): the verifier accepts
+        # pointer comparisons only at 64 bits, and they are unsigned.
+        u64 = IntTy(64, False)
+        lhs = convert(builder, lhs, lhs_desc, u64)
+        rhs = convert(builder, rhs, rhs_desc, u64)
+        return handle_comparator(func, builder, cond.ops[0], lhs, rhs, signed=False)
     if lhs_desc is not None and rhs_desc is not None:
         # Both integers: compare in the promoted type, which also picks the
         # signed or unsigned predicate (u64 > s64 is an unsigned compare in C).
 
@@ -13,34 +13,50 @@
   packet range whose offset stays within MAX_PACKET_OFF (0xffff);
 - pointer - pointer (e.g. data_end - data) is an ordinary 64-bit length.
 
-Only direct field reads (`ctx.data`) are recognised so far; a local copied
-from one (`d = ctx.data`) is an ordinary integer again. Comparisons between
-packet pointers are the next site of the same rule.
+The field read gives its value a PktPtrTy descriptor (a 64-bit unsigned
+IntTy tagged with the verifier's kind), and the rules key on that descriptor,
+so they follow the pointer through locals (`d = ctx.data`), through
+`d + 14`, and into comparisons (`ctx.data + 34 > ctx.data_end` is a 64-bit
+unsigned compare). packet-end pointers take no offset at all, and nothing
+narrows a packet pointer below 64 bits.
 """
 
 import ast
 
-# Context struct -> fields the verifier treats as packet pointers. Taken from
-# the verifier's is_valid_access callbacks, restricted to the fields that
-# vmlinux declares as 32-bit integers.
+from pythonbpf.type_deducer import PktPtrTy
+
+# Context struct -> {field: packet kind}. Taken from the verifier's
+# is_valid_access callbacks, restricted to the fields vmlinux declares as
+# 32-bit integers.
 PACKET_POINTER_FIELDS = {
-    "struct_xdp_md": {"data", "data_end", "data_meta"},
-    "struct___sk_buff": {"data", "data_end", "data_meta"},
+    "struct_xdp_md": {"data": "pkt", "data_meta": "pkt_meta", "data_end": "pkt_end"},
+    "struct___sk_buff": {
+        "data": "pkt",
+        "data_meta": "pkt_meta",
+        "data_end": "pkt_end",
+    },
 }
 
 MAX_PACKET_OFF = 0xFFFF
 
 
-def is_packet_pointer(expr, local_sym_tab) -> bool:
-    """True for `ctx.<field>` where ctx is a context parameter of one of the
-    structs above and the field is one of its packet-pointer fields."""
+def packet_kind(expr, local_sym_tab) -> "str | None":
+    """The packet kind of `ctx.<field>` when ctx is a context parameter of one
+    of the structs above and the field is one of its packet-pointer fields;
+    None otherwise. This is the only place a PktPtrTy originates: from here it
+    travels as a descriptor, through locals, binop results and comparisons."""
     if not (isinstance(expr, ast.Attribute) and isinstance(expr.value, ast.Name)):
-        return False
+        return None
     sym = (local_sym_tab or {}).get(expr.value.id)
     if sym is None:
-        return False
+        return None
     meta = sym.metadata
     struct_name = meta if isinstance(meta, str) else getattr(meta, "__name__", None)
     if not isinstance(struct_name, str):
-        return False
-    return expr.attr in PACKET_POINTER_FIELDS.get(struct_name, set())
+        return None
+    return PACKET_POINTER_FIELDS.get(struct_name, {}).get(expr.attr)
+
+
+def packet_type(expr, local_sym_tab) -> "PktPtrTy | None":
+    kind = packet_kind(expr, local_sym_tab)
+    return PktPtrTy(kind) if kind is not None else None
@@ -13,6 +13,7 @@
 from llvmlite import ir
 
 from pythonbpf.type_deducer import (
+    PktPtrTy,
     IntTy,
     ctypes_to_ir,
     is_ctypes,
@@ -21,10 +22,12 @@
 )
 from .operators import usual_arithmetic_conversions
 from .vmlinux_registry import VmlinuxHandlerRegistry
-from .packet_pointer import is_packet_pointer
+from .packet_pointer import packet_type
 
 
 def _as_intty(ty):
+    if isinstance(ty, PktPtrTy):
+        return ty
     if isinstance(ty, ir.IntType):
         return IntTy(ty.width, signedness(ty))
     return None
@@ -47,12 +50,12 @@ def infer_int_type(expr, local_sym_tab, compilation_context):
         return None
 
     if isinstance(expr, ast.BinOp):
-        if is_packet_pointer(expr.left, local_sym_tab) or is_packet_pointer(
-            expr.right, local_sym_tab
-        ):
-            return IntTy(64, False)  # packet-pointer arithmetic is 64-bit
         left = infer_int_type(expr.left, local_sym_tab, compilation_context)
         right = infer_int_type(expr.right, local_sym_tab, compilation_context)
+        if isinstance(left, PktPtrTy) and isinstance(right, PktPtrTy):
+            return IntTy(64, False)  # pointer - pointer: a length
+        if isinstance(left, PktPtrTy) or isinstance(right, PktPtrTy):
+            return left if isinstance(left, PktPtrTy) else right
         if left is None or right is None:
             return None
         return usual_arithmetic_conversions(left, right)
@@ -88,6 +91,9 @@ def infer_int_type(expr, local_sym_tab, compilation_context):
         return None
 
     if isinstance(expr, ast.Attribute) and isinstance(expr.value, ast.Name):
+        pkt_ty = packet_type(expr, local_sym_tab)
+        if pkt_ty is not None:
+            return pkt_ty
         base = local_sym_tab.get(expr.value.id)
         if base is None:
             return None
 
@@ -1,7 +1,7 @@
 import logging
 from llvmlite import ir
 from .ir_ops import deref_to_depth
-from pythonbpf.type_deducer import IntTy, signedness
+from pythonbpf.type_deducer import IntTy, PktPtrTy, signedness
 from .operators import COMPARISON_OPS
 
 logger = logging.getLogger(__name__)
@@ -52,6 +52,15 @@ def convert(builder, val, from_ty, to_ty):
     descriptors (see type_deducer.IntTy); the physical width comes from the
     value itself, which may already be wider than its descriptor says.
     """
+    if (
+        isinstance(from_ty, PktPtrTy)
+        and isinstance(to_ty, ir.IntType)
+        and to_ty.width < 64
+    ):
+        raise TypeError(
+            f"a packet pointer ({from_ty.describe()}) cannot be narrowed to "
+            f"i{to_ty.width}; the verifier only accepts it at 64 bits"
+        )
     if not (isinstance(to_ty, ir.IntType) and isinstance(val.type, ir.IntType)):
         # Every caller either checks both sides are integers or sits on a path
         # that only carries integers, so reaching here is a type error that
 
@@ -41,6 +41,33 @@ def describe(self) -> str:
         return f"{'i' if self.signed else 'u'}{self.width}"
 
 
+PACKET_KINDS = ("pkt", "pkt_meta", "pkt_end")
+
+
+class PktPtrTy(IntTy):
+    """A packet pointer: 64-bit, unsigned, and tagged with the verifier's kind
+    for it (packet data, packet metadata, or packet end). It is an IntTy so
+    every integer path accepts it; the few sites that must treat it as a
+    pointer check isinstance(ty, PktPtrTy) before the integer rules apply.
+    See pythonbpf/expr/packet_pointer.py for where kinds come from and the
+    rules applied to them."""
+
+    def __new__(cls, kind: str):
+        return IntTy.__new__(cls, 64, False)
+
+    def __init__(self, kind: str):
+        if kind not in PACKET_KINDS:
+            raise ValueError(f"unknown packet pointer kind {kind!r}")
+        IntTy.__init__(self, 64, False)
+        self.kind = kind
+
+    def __getnewargs__(self):  # type: ignore[override]
+        return (self.kind,)
+
+    def describe(self) -> str:
+        return f"{self.kind}*"
+
+
 def int_literal_type(value: int) -> IntTy:
     """C's type for an integer constant: `int` if the value fits, else
     `long long`. Literals and enum constants alike; an enum constant is an