diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index a7fe2f9..a83328e 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -3669,8 +3669,8 @@ source function, with the construct that identifies each pair.
 | `0x3F623350` ICMP send | `icmp_send()` `ip_icmp.c:510` | final transmit of the reply |
 | `0x3F62EA00` IP transmit | `ip_output()` `sys/netinet/ip_output.c:43` | htons of total length and fragment word, header checksum at byte 10, then the interface's output |
 | `0x3F63A340` TCP input | `tcp_input()` `sys/netinet/tcp_input.c:189` | states 3..10 tables (section 24) are `tcp_input`'s `switch (tp->t_state)` |
-| TCP options | `tcp_dooptions()` `tcp_input.c:1309` | — |
-| MSS handling | `tcp_mss()` `tcp_input.c:1501` | — |
+| TCP options | `tcp_dooptions()` `tcp_input.c:1309` | called from `tcp_input` at `:387` and `:567` |
+| MSS handling | `tcp_mss()` `tcp_input.c:1501` | called from `tcp_dooptions` at `:1343` (`(void) tcp_mss(tp, mss); /* sets t_maxseg */`) |
 | `0x3F6540C0` UDP input | `udp_input()` `sys/netinet/udp_usrreq.c:55` | header length checks, then the PCB lookup below |
 | `0x3F656200` UDP header builder | `udp_output()` `udp_usrreq.c:351` | writes protocol 17 into the header (section 20) |
 | `0x3F61E490` binding lookup | **`in_pcblookup()` `sys/netinet/in_pcb.c:428`** | exact match of the algorithm — see 53.2 |