I've noticed the following possible inconsistency.
1) ip_input() is called with M_FASTFWD_OUR set
2) ip_off is not "adjusted" to host representation
3) ip reassembly is erroneously called.
I don't have an actual case that can test this, but it seems like an issue.
Barney