This seems to fix them problem, where the w/ Jason's patch, the first
fragment did not have the header length.

Index: ip_output.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/ip_output.c,v
retrieving revision 1.144
diff -u -r1.144 ip_output.c
--- ip_output.c	26 Feb 2005 22:45:12 -0000	1.144
+++ ip_output.c	5 Mar 2005 02:07:25 -0000
@@ -978,6 +978,7 @@
 			KASSERT((m->m_pkthdr.csum_flags & M_CSUM_IPv4) == 0);
 		} else {
 			m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
+			m->m_pkthdr.csum_data |= hlen << 16;
 		}
 		ipstat.ips_ofragments++;
 		fragments++;
@@ -997,6 +998,7 @@
 		m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4;
 	} else {
 		KASSERT(m->m_pkthdr.csum_flags & M_CSUM_IPv4);
+		m->m_pkthdr.csum_data |= hlen << 16;
 	}
 sendorfree:
 	/*
@@ -1038,7 +1040,7 @@
 	if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv4) != 0)
 		csum = 0xffff;
 
-	offset += m->m_pkthdr.csum_data;	/* checksum offset */
+	offset += M_CSUM_DATA_IPv4_OFFSET(m->m_pkthdr.csum_data);
 
 	if ((offset + sizeof(u_int16_t)) > m->m_len) {
 		/* This happen when ip options were inserted