Index: ip_input.c
===================================================================
--- ip_input.c	(revision 294529)
+++ ip_input.c	(working copy)
@@ -530,7 +530,7 @@
 #ifdef IPSEC
 	/* For now we do not handle IPSEC in tryforward. */
 	if (!key_havesp(IPSEC_DIR_INBOUND) && !key_havesp(IPSEC_DIR_OUTBOUND) &&
-	    (V_ipforwarding == 1))
+	    (V_ipforwarding == 1) && !PFIL_HOOKED(&V_inet_pfil_hook))
 		if (ip_tryforward(m) == NULL)
 			return;
 	/*
@@ -539,7 +539,7 @@
 	if (ip_ipsec_filtertunnel(m))
 		goto passin;
 #else
-	if (V_ipforwarding == 1)
+	if ((V_ipforwarding == 1) && (!PFIL_HOOKED(&V_inet_pfil_hook)))
 		if (ip_tryforward(m) == NULL)
 			return;
 #endif /* IPSEC */