diff -r f20022c2103d -r 4014474b4ff7 sys/dev/cxgbe/adapter.h
--- a/sys/dev/cxgbe/adapter.h	Thu Jun 18 17:48:53 2015 -0700
+++ b/sys/dev/cxgbe/adapter.h	Tue Jun 16 23:10:50 2015 -0700
@@ -304,10 +304,20 @@ struct cluster_metadata {
 #endif
 };
 
+#if 1
+struct last_mbuf {
+	uint8_t raw[128];
+	struct mbuf *m;
+};
+#endif
+
 struct fl_sdesc {
 	caddr_t cl;
 	uint16_t nmbuf;	/* # of driver originated mbufs with ref on cluster */
 	struct cluster_layout cll;
+#if 1
+	struct last_mbuf last_mbuf;
+#endif
 };
 
 struct tx_desc {
@@ -526,6 +536,9 @@ struct sge_rxq {
 
 	/* stats for not-that-common events */
 
+#if 1
+	struct last_mbuf *last_mbuf;
+#endif
 } __aligned(CACHE_LINE_SIZE);
 
 static inline struct sge_rxq *
diff -r f20022c2103d -r 4014474b4ff7 sys/dev/cxgbe/t4_sge.c
--- a/sys/dev/cxgbe/t4_sge.c	Thu Jun 18 17:48:53 2015 -0700
+++ b/sys/dev/cxgbe/t4_sge.c	Tue Jun 16 23:10:50 2015 -0700
@@ -1570,6 +1570,13 @@ get_scatter_segment(struct adapter *sc, 
 	int len, blen;
 	caddr_t payload;
 
+#if 1
+	if (__predict_false(fr_offset < 0 || fr_offset > 10000))
+		panic("%s: fr_offset %u", __func__, fr_offset);
+	if (__predict_false(remaining < 0 || remaining > 10000))
+		panic("%s: remaining %u", __func__, remaining);
+#endif
+
 	blen = hwb->size - fl->rx_offset;	/* max possible in this buf */
 	len = min(remaining, blen);
 	payload = sd->cl + cll->region1 + fl->rx_offset;
@@ -1647,6 +1654,15 @@ get_scatter_segment(struct adapter *sc, 
 	if (fr_offset == 0)
 		m->m_pkthdr.len = remaining;
 	m->m_len = len;
+#if 1
+	/*
+	 * This is the mbuf for this scatter segment.  It may have M_PKTHDR but
+	 * only m_pkthdr.len is set correctly at this point.  Most other header
+	 * fields are set later by t4_eth_rx.
+	 */
+	bcopy(m, &sd->last_mbuf, 128);
+	sd->last_mbuf.m = m;	/* save address too. */
+#endif
 
 	if (fl->flags & FL_BUF_PACKING) {
 		fl->rx_offset += blen;
@@ -1779,6 +1795,11 @@ t4_eth_rx(struct sge_iq *iq, const struc
 		rxq->vlan_extraction++;
 	}
 
+#if 1
+	/* This is the header mbuf that cxgbe passed up to the stack */
+	bcopy(m0, &rxq->last_mbuf[iq->cidx], 128);
+	rxq->last_mbuf[iq->cidx].m = m0;
+#endif
 #if defined(INET) || defined(INET6)
 	if (cpl->l2info & htobe32(F_RXF_LRO) &&
 	    iq->flags & IQ_LRO_ENABLED &&
@@ -2960,6 +2981,10 @@ alloc_rxq(struct port_info *pi, struct s
 		rxq->iq.flags |= IQ_LRO_ENABLED;
 #endif
 	rxq->ifp = pi->ifp;
+#if 1
+	rxq->last_mbuf = malloc(rxq->iq.sidx * sizeof(struct last_mbuf),
+	    M_CXGBE, M_ZERO | M_WAITOK);
+#endif
 
 	children = SYSCTL_CHILDREN(oid);