git: c08a97fa27b9 - main - ipfilter: Fix checksum update for NAT_DIVERTOUT

The branch main has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=c08a97fa27b914988ef092352872b2f455abb7c3

commit c08a97fa27b914988ef092352872b2f455abb7c3
Author:     Cy Schubert <[email protected]>
AuthorDate: 2026-08-17 23:23:32 +0000
Commit:     Cy Schubert <[email protected]>
CommitDate: 2026-08-18 14:42:23 +0000

    ipfilter: Fix checksum update for NAT_DIVERTOUT
    
    When taking a snapshot of the before ip_len (s1) for comparison with the
    after-translated ip_len (s2), we must convert it from network to host
    byte order before we can use it. Add the missing ntohs() call.
    
    PR:             296944
    MFC after:      3 days
---
 sys/netpfil/ipfilter/netinet/ip_nat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c
index bf091e3b0e12..9ee1c5d24ed1 100644
--- a/sys/netpfil/ipfilter/netinet/ip_nat.c
+++ b/sys/netpfil/ipfilter/netinet/ip_nat.c
@@ -5147,7 +5147,7 @@ ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
 		ip_fillid(ip, V_ip_random_id);
 		s2 = ntohs(ip->ip_id);
 
-		s1 = ip->ip_len;
+		s1 = ntohs(ip->ip_len);
 		ip->ip_len = ntohs(ip->ip_len);
 		ip->ip_len += fin->fin_plen;
 		ip->ip_len = htons(ip->ip_len);