git: 008259bb8355 - stable/15 - ipfilter: Fix checksum update for NAT_DIVERTOUT

The branch stable/15 has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=008259bb83551cf3d61f273b9bab682e00fa7940

commit 008259bb83551cf3d61f273b9bab682e00fa7940
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2026-08-17 23:23:32 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-08-24 05:35:13 +0000

    ipfilter: Fix checksum update for NAT_DIVERTOUT
    
    When taking a snapshot of the before ip_len (s1) for comparison with the
    after-translated ip_len (s2), we must convert it from network to host
    byte order before we can use it. Add the missing ntohs() call.
    
    PR:             296944
    MFC after:      3 days
    
    (cherry picked from commit c08a97fa27b914988ef092352872b2f455abb7c3)
---
 sys/netpfil/ipfilter/netinet/ip_nat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c
index bf091e3b0e12..9ee1c5d24ed1 100644
--- a/sys/netpfil/ipfilter/netinet/ip_nat.c
+++ b/sys/netpfil/ipfilter/netinet/ip_nat.c
@@ -5147,7 +5147,7 @@ ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
 		ip_fillid(ip, V_ip_random_id);
 		s2 = ntohs(ip->ip_id);
 
-		s1 = ip->ip_len;
+		s1 = ntohs(ip->ip_len);
 		ip->ip_len = ntohs(ip->ip_len);
 		ip->ip_len += fin->fin_plen;
 		ip->ip_len = htons(ip->ip_len);