Use in_conninfo from PCB to be able disambiguate a possibly ambiguous address. --- sys/netinet/tcp_output.c (svn+ssh://svn.freebsd.org/base/head) (revision 261548) +++ sys/netinet/tcp_output.c (working copy) @@ -1070,7 +1070,7 @@ send: #ifdef TCP_SIGNATURE if (tp->t_flags & TF_SIGNATURE) { int sigoff = to.to_signature - opt; - tcp_signature_compute(m, 0, len, optlen, + tcp_signature_compute(m, &tp->t_inpcb->inp_inc, len, optlen, (u_char *)(th + 1) + sigoff, IPSEC_DIR_OUTBOUND); } #endif