Index: net/bridge.c
===================================================================
RCS file: /cvsdrop/mlaier/fcvs/src/sys/net/bridge.c,v
retrieving revision 1.74
diff -u -r1.74 bridge.c
--- net/bridge.c	13 Feb 2004 19:14:15 -0000	1.74
+++ net/bridge.c	17 Feb 2004 11:07:48 -0000
@@ -921,7 +921,7 @@
     DDB(quad_t ticks; ticks = rdtsc();)
 
     /* did we match a firewall rule ? */
-    args.rule = ip_dn_find_rule(m0);
+    args.rule = ip_dn_claim_rule(m0);
     if (args.rule)
         shared = 0;			/* For sure this is our own mbuf. */
     else
Index: net/if_ethersubr.c
===================================================================
RCS file: /cvsdrop/mlaier/fcvs/src/sys/net/if_ethersubr.c,v
retrieving revision 1.157
diff -u -r1.157 if_ethersubr.c
--- net/if_ethersubr.c	15 Feb 2004 21:27:27 -0000	1.157
+++ net/if_ethersubr.c	17 Feb 2004 11:08:10 -0000
@@ -322,7 +322,7 @@
 int
 ether_output_frame(struct ifnet *ifp, struct mbuf *m)
 {
-	struct ip_fw *rule = ip_dn_find_rule(m);
+	struct ip_fw *rule = ip_dn_claim_rule(m);
 
 	if (rule == NULL && BDG_ACTIVE(ifp)) {
 		/*
@@ -605,7 +605,7 @@
 #if defined(NETATALK)
 	struct llc *l;
 #endif
-	struct ip_fw *rule = ip_dn_find_rule(m);
+	struct ip_fw *rule = ip_dn_claim_rule(m);
 
 	KASSERT(ifp != NULL, ("ether_demux: NULL interface pointer"));
 
Index: netinet/ip_dummynet.h
===================================================================
RCS file: /cvsdrop/mlaier/fcvs/src/sys/netinet/ip_dummynet.h,v
retrieving revision 1.29
diff -u -r1.29 ip_dummynet.h
--- netinet/ip_dummynet.h	13 Feb 2004 22:26:36 -0000	1.29
+++ netinet/ip_dummynet.h	17 Feb 2004 11:07:01 -0000
@@ -356,9 +356,12 @@
  * Return the IPFW rule associated with the dummynet tag; if any.
  */
 static __inline struct ip_fw *
-ip_dn_find_rule(struct mbuf *m)
+ip_dn_claim_rule(struct mbuf *m)
 {
 	struct m_tag *mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
+	/* Avoid confusion, but make sure we free the memory later. */
+	if (mtag)
+		mtag->m_tag_id = PACKET_TAG_NONE;
 	return mtag ?  ((struct dn_pkt_tag *)(mtag+1))->rule : NULL;
 }
 #endif
Index: netinet/ip_input.c
===================================================================
RCS file: /cvsdrop/mlaier/fcvs/src/sys/netinet/ip_input.c,v
retrieving revision 1.262
diff -u -r1.262 ip_input.c
--- netinet/ip_input.c	13 Feb 2004 19:20:43 -0000	1.262
+++ netinet/ip_input.c	17 Feb 2004 11:07:25 -0000
@@ -320,7 +320,7 @@
 	args.eh = NULL;
 	args.oif = NULL;
 	args.next_hop = ip_claim_next_hop(m);
-	args.rule = ip_dn_find_rule(m);
+	args.rule = ip_dn_claim_rule(m);
 
 	M_ASSERTPKTHDR(m);
 
Index: netinet/ip_var.h
===================================================================
RCS file: /cvsdrop/mlaier/fcvs/src/sys/netinet/ip_var.h,v
retrieving revision 1.82
diff -u -r1.82 ip_var.h
--- netinet/ip_var.h	13 Feb 2004 19:14:15 -0000	1.82
+++ netinet/ip_var.h	17 Feb 2004 11:03:47 -0000
@@ -207,7 +207,12 @@
 	struct m_tag *mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
 	if (mtag) {
 		struct sockaddr_in *sin = *(struct sockaddr_in **)(mtag+1);
-		m_tag_delete(m, mtag);
+		/*
+		 * Keep the tag in the SLIST in order to free the asociated
+		 * memory with the mbuf, but remove the id to avoid
+		 * confusion.
+		 */
+		mtag->m_tag_id = PACKET_TAG_NONE;
 		return sin;
 	} else
 		return NULL;