Index: sys/netgraph/ng_nat.c
===================================================================
--- sys/netgraph/ng_nat.c
+++ sys/netgraph/ng_nat.c
@@ -810,8 +810,10 @@
 	c = (char *)mtodo(m, ipofs);
 	ip = (struct ip *)mtodo(m, ipofs);
 
-	KASSERT(m->m_pkthdr.len == ipofs + ntohs(ip->ip_len),
-	    ("ng_nat: ip_len != m_pkthdr.len"));
+	if(ip->ip_v != IPVERSION)
+		goto send;		/* other IP version, let it pass */
+	if(m->m_pkthdr.len < ipofs + ntohs(ip->ip_len))
+		goto send;		/* packet too short (i.e. fragmented or broken) */
 
 	/*
 	 * We drop packet when: