--- a/usr/src/uts/common/inet/tcp/tcp.c	Tue Jan 12 10:56:31 2010 +0800
+++ b/usr/src/uts/common/inet/tcp/tcp.c	Mon Jan 11 21:01:02 2010 -0800
@@ -16588,10 +16588,8 @@
 			ixa->ixa_flags &= ~IXAF_REACH_CONF;
 		}
 
-		/*
-		 * Append LSO information, both flags and mss, to the mp.
-		 */
 		if (do_lso_send) {
+			/* Append LSO information to the mp. */
 			lso_info_set(mp, mss, HW_LSO);
 			ixa->ixa_fragsize = IP_MAXPACKET;
 			ixa->ixa_extra_ident = num_lso_seg - 1;
@@ -16610,6 +16608,12 @@
 			TCP_STAT(tcps, tcp_lso_times);
 			TCP_STAT_UPDATE(tcps, tcp_lso_pkt_out, num_lso_seg);
 		} else {
+			/*
+			 * Make sure to clean up LSO information. Wherever a
+			 * new mp uses the prepended header room after dupb(),
+			 * lso_info_cleanup() should be called.
+			 */
+			lso_info_cleanup(mp);
 			tcp_send_data(tcp, mp);
 			BUMP_LOCAL(tcp->tcp_obsegs);
 		}

--- a/usr/src/uts/common/os/strsubr.c	Tue Jan 12 10:56:31 2010 +0800
+++ b/usr/src/uts/common/os/strsubr.c	Mon Jan 11 21:01:02 2010 -0800
@@ -23,7 +23,7 @@
 
 
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -8516,6 +8516,7 @@
 lso_info_set(mblk_t *mp, uint32_t mss, uint32_t flags)
 {
 	ASSERT(DB_TYPE(mp) == M_DATA);
+	ASSERT((flags & ~HW_LSO_FLAGS) == 0);
 
 	/* Set the flags */
 	DB_LSOFLAGS(mp) |= flags;
@@ -8523,12 +8524,22 @@
 }
 
 void
+lso_info_cleanup(mblk_t *mp)
+{
+	ASSERT(DB_TYPE(mp) == M_DATA);
+
+	/* Clear the flags */
+	DB_LSOFLAGS(mp) &= ~HW_LSO_FLAGS;
+	DB_LSOMSS(mp) = 0;
+}
+
+void
 lso_info_get(mblk_t *mp, uint32_t *mss, uint32_t *flags)
 {
 	ASSERT(DB_TYPE(mp) == M_DATA);
 
 	if (flags != NULL) {
-		*flags = DB_CKSUMFLAGS(mp) & HW_LSO;
+		*flags = DB_CKSUMFLAGS(mp) & HW_LSO_FLAGS;
 		if ((*flags != 0) && (mss != NULL))
 			*mss = (uint32_t)DB_LSOMSS(mp);
 	}

--- a/usr/src/uts/common/sys/pattr.h	Tue Jan 12 10:56:31 2010 +0800
+++ b/usr/src/uts/common/sys/pattr.h	Mon Jan 11 21:01:02 2010 -0800
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -99,6 +99,7 @@
 #define	HW_LSO			0x10	/* On Transmit: hardware does LSO */
 					/* On Receive: N/A */
 
+#define	HW_LSO_FLAGS		HW_LSO	/* All LSO flags, currently only one */
 
 /*
  * Structure used for zerocopy attribute.

--- a/usr/src/uts/common/sys/strsubr.h	Tue Jan 12 10:56:31 2010 +0800
+++ b/usr/src/uts/common/sys/strsubr.h	Mon Jan 11 21:01:02 2010 -0800
@@ -23,7 +23,7 @@
 
 
 /*
- * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -1244,6 +1244,7 @@
     uint32_t *, uint32_t *, uint32_t *, uint32_t *, uint32_t *);
 extern void lso_info_set(mblk_t *, uint32_t, uint32_t);
 extern void lso_info_get(mblk_t *, uint32_t *, uint32_t *);
+extern void lso_info_cleanup(mblk_t *);
 extern unsigned int bcksum(uchar_t *, int, unsigned int);
 extern boolean_t is_vmloaned_mblk(mblk_t *, struct multidata_s *,
     struct pdesc_s *);