Index: head/sys/dev/sfxge/sfxge_tx.c
===================================================================
--- head/sys/dev/sfxge/sfxge_tx.c
+++ head/sys/dev/sfxge/sfxge_tx.c
@@ -1025,7 +1025,7 @@
 		KASSERT(n_dma_seg, ("no payload found in TSO packet"));
 		++dma_seg;
 	}
-	tso.in_len = dma_seg->ds_len + (tso.header_len - skipped);
+	tso.in_len = dma_seg->ds_len - (tso.header_len - skipped);
 	tso.dma_addr = dma_seg->ds_addr + (tso.header_len - skipped);
 
 	id = txq->added & txq->ptr_mask;