Index: tcp_input.c
===================================================================
--- tcp_input.c	(revision 247398)
+++ tcp_input.c	(working copy)
@@ -768,6 +768,30 @@
 	} else
 		ti_locked = TI_UNLOCKED;
 
+	/*
+	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
+	 */
+#ifdef INET6
+        if (isipv6 && (m->m_flags & M_IP6_NEXTHOP)) {
+		m->m_flags &= ~M_IP6_NEXTHOP;
+		fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
+		if (fwd_tag != NULL)
+			m_tag_unlink(m, fwd_tag);
+	}
+#ifdef INET
+	else if (!isipv6 && (m->m_flags & M_IP_NEXTHOP)) {
+#endif
+#elif defined(INET)
+	if (m->m_flags & M_IP_NEXTHOP) {
+#endif
+#if defined(INET)
+		m->m_flags &= ~M_IP_NEXTHOP;
+		fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
+		if (fwd_tag != NULL)
+			m_tag_unlink(m, fwd_tag);
+	}
+#endif
+
 findpcb:
 #ifdef INVARIANTS
 	if (ti_locked == TI_WLOCKED) {
@@ -777,23 +801,7 @@
 	}
 #endif
 
-	/*
-	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
-	 */
-        if (
 #ifdef INET6
-	    (isipv6 && (m->m_flags & M_IP6_NEXTHOP))
-#ifdef INET
-	    || (!isipv6 && (m->m_flags & M_IP_NEXTHOP))
-#endif
-#endif
-#if defined(INET) && !defined(INET6)
-	    (m->m_flags & M_IP_NEXTHOP)
-#endif
-	    )
-		fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
-
-#ifdef INET6
 	if (isipv6 && fwd_tag != NULL) {
 		struct sockaddr_in6 *next_hop6;
 
@@ -817,10 +825,6 @@
 			    th->th_dport, INPLOOKUP_WILDCARD |
 			    INPLOOKUP_WLOCKPCB, m->m_pkthdr.rcvif);
 		}
-		/* Remove the tag from the packet.  We don't need it anymore. */
-		m_tag_delete(m, fwd_tag);
-		m->m_flags &= ~M_IP6_NEXTHOP;
-		fwd_tag = NULL;
 	} else if (isipv6) {
 		inp = in6_pcblookup_mbuf(&V_tcbinfo, &ip6->ip6_src,
 		    th->th_sport, &ip6->ip6_dst, th->th_dport,
@@ -855,10 +859,6 @@
 			    th->th_dport, INPLOOKUP_WILDCARD |
 			    INPLOOKUP_WLOCKPCB, m->m_pkthdr.rcvif);
 		}
-		/* Remove the tag from the packet.  We don't need it anymore. */
-		m_tag_delete(m, fwd_tag);
-		m->m_flags &= ~M_IP_NEXTHOP;
-		fwd_tag = NULL;
 	} else
 		inp = in_pcblookup_mbuf(&V_tcbinfo, ip->ip_src,
 		    th->th_sport, ip->ip_dst, th->th_dport,
@@ -970,6 +970,8 @@
 		if (tcp_twcheck(inp, &to, th, m, tlen))
 			goto findpcb;
 		INP_INFO_WUNLOCK(&V_tcbinfo);
+		if (fwd_tag != NULL)
+			m_tag_free(fwd_tag);
 		return;
 	}
 	/*
@@ -1020,6 +1022,10 @@
 		}
 		INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
 	}
+	if (fwd_tag) {
+		m_tag_free(fwd_tag);
+		fwd_tag = NULL;
+	}
 
 #ifdef MAC
 	INP_WLOCK_ASSERT(inp);
@@ -1429,6 +1435,8 @@
 
 drop:
 	INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
+	if (fwd_tag != NULL)
+		m_tag_free(fwd_tag);
 	if (s != NULL)
 		free(s, M_TCPLOG);
 	if (m != NULL)