0040 -> 4000 looks like a network byte order issue, perhaps. I have a faint memory of issues of when tcpdump looks at packets, determining whether UDP checksums are shown, for example. Possibly this is some artefact of outboarding?