Index: sys/netgraph/ng_ipfw.c
===================================================================
--- sys/netgraph/ng_ipfw.c
+++ sys/netgraph/ng_ipfw.c
@@ -233,6 +233,8 @@
 	struct ipfw_rule_ref *r;
 	struct mbuf *m;
 	struct ip *ip;
+	struct epoch_tracker et;
+	int ret;
 
 	NGI_GET_M(item, m);
 	NG_FREE_ITEM(item);
@@ -250,16 +252,19 @@
 	ip = mtod(m, struct ip *);
 
 	r = (struct ipfw_rule_ref *)(tag + 1);
+	NET_EPOCH_ENTER(et);
 	if (r->info & IPFW_INFO_IN) {
 		switch (ip->ip_v) {
 #ifdef INET
 		case IPVERSION:
 			ip_input(m);
+			NET_EPOCH_EXIT(et);
 			return (0);
 #endif
 #ifdef INET6
 		case IPV6_VERSION >> 4:
 			ip6_input(m);
+			NET_EPOCH_EXIT(et);
 			return (0);
 #endif
 		}
@@ -267,18 +272,22 @@
 		switch (ip->ip_v) {
 #ifdef INET
 		case IPVERSION:
-			return (ip_output(m, NULL, NULL, IP_FORWARDING,
-			    NULL, NULL));
+			ret = ip_output(m, NULL, NULL, IP_FORWARDING, NULL,
+			    NULL);
+			NET_EPOCH_EXIT(et);
+			return (ret);
 #endif
 #ifdef INET6
 		case IPV6_VERSION >> 4:
-			return (ip6_output(m, NULL, NULL, 0, NULL,
-			    NULL, NULL));
+			ret = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
+			NET_EPOCH_EXIT(et);
+			return (ret);
 #endif
 		}
 	}
 
 	/* unknown IP protocol version */
+	NET_EPOCH_EXIT(et);
 	NG_FREE_M(m);
 	return (EPROTONOSUPPORT);
 }