Hi, Can you try this with fastforwarding off? It looks like a double free somewhere in the ip_fastforward() routine. Someone frees m but does not NULL it out and at the drop: label the mbuf m is valid but the data within it has already been freed. Knowing if this is related only to the fast forwarding case will help. Best, George