int
ip_output(struct mbuf *m, struct mbuf *opt, struct route *ro,
        int flags, struct ip_moptions *imo, struct inpcb *inp)
{
        struct ip *ip;
        struct ifnet *ifp = NULL;       /* keep compiler happy */
        struct mbuf *m0;
        int hlen = sizeof (struct ip);
        int len, off, error = 0;
        struct sockaddr_in *dst = NULL; /* keep compiler happy */
        struct in_ifaddr *ia = NULL;
        int isbroadcast, sw_csum;
        struct in_addr pkt_dst;
        struct route iproute;
        struct m_tag *dummytag;
#ifdef IPSEC
        struct secpolicy *sp = NULL;
#endif
#ifdef FAST_IPSEC
        struct secpolicy *sp = NULL;
        struct tdb_ident *tdbi;
        int s;
#endif /* FAST_IPSEC */
        struct ip_fw_args args;
        int src_was_INADDR_ANY = 0;     /* as the name says... */

        args.eh = NULL;
        args.rule = NULL;
==== THEIRS ip_output.c#84

        M_ASSERTPKTHDR(m);

        args.next_hop = ip_claim_next_hop(m);
        dummytag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
        if (dummytag != NULL) {
                struct dn_pkt_tag *dt = (struct dn_pkt_tag *)(dummytag+1);
                /*
                 * Prevent lower layers from finding the tag
                 * Cleanup and free is done below
                 */
                m_tag_unlink(m, dummytag);
                /*
                 * the packet was already tagged, so part of the
                 * processing was already done, and we need to go down.
                 * Get parameters from the header.
                 */
                args.rule = dt->rule;
                ro = &(dt->ro);
                dst = dt->dn_dst;
                ifp = dt->ifp;
        }
==== YOURS ip_output.c
        args.next_hop = ip_claim_next_hop(m);

#ifdef IPSEC
        so = ipsec_getsocket(m);
        (void)ipsec_setsocket(m, NULL);
#endif /*IPSEC*/
<<<<
        if (ro == NULL) {
                ro = &iproute;
                bzero(ro, sizeof (*ro));
        }

        if (inp != NULL)
                INP_LOCK_ASSERT(inp);

        /*
         * When packet comes from dummynet restore state from
         * previous processing instead of the header.  Yech!
         *
         * XXX add conditional compilation?
         */
        dummytag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
        if (dummytag != NULL) {
                struct dn_pkt_tag *dt = (struct dn_pkt_tag *)(dummytag+1);

                /*
                 * NB: the route in the tag is known to have a
                 * reference that must be free'd, but doing this
                 * before the storage is reclaimed is painful due
                 * to some of the contorted code in this routine.
                 * So instead unlink the tag from the mbuf so it
                 * doesn't get reclaimed and do the cleanup explicitly
                 * below.  We should be able to do this automatically
                 * using a uma dtor method when m_tag's can be
                 * allocated from zones.
                 */
                m_tag_unlink(m, dummytag);

                args.rule = dt->rule;
                ro = &dt->ro;
                dst = dt->dn_dst;
                ifp = dt->ifp;

                ip = mtod(m, struct ip *);
                hlen = ip->ip_hl << 2 ;
                if (ro->ro_rt)
                        ia = ifatoia(ro->ro_rt->rt_ifa);
                goto sendit;
        }

        if (opt) {
                len = 0;
                m = ip_insertoptions(m, opt, &len);
                if (len != 0)
                        hlen = len;
        }