> > > > generally, if outgoing interface decision is changed from lo0 after
> > > > udp_output check it, it can be a problem.
> > > 
> > > Isn't this the case for all hardware-accelerated checkhsums?
> > 
> > yes.
> > only difference is, for lo checksum omission,
> > the decision is done a little earlier.
> 
> So, if I had a rule in ipf.conf:
> 
> pass out on ex0 (...) to fxp0
> 
> whch should cause the matching packets to leave through fxp0 instead of
> ex0, and hw checksums enabled on ex0 and disabled on fxp0, they would go
> out on fxp0 with wrong checksums?

no idea.  it depends on how ipfilter acutually implements that forwarding.

YAMAMOTO Takashi