Index: sys/netinet/tcp_lro.c
===================================================================
--- sys/netinet/tcp_lro.c
+++ sys/netinet/tcp_lro.c
@@ -378,11 +378,14 @@
 
 #ifdef INET6
 static int
-tcp_lro_rx_ipv6(struct lro_ctrl *lc, struct mbuf *m, struct ip6_hdr *ip6,
-    struct tcphdr **th)
+tcp_lro_rx_ipv6(struct lro_ctrl *lc, struct lro_entry *le, struct mbuf *m,
+    struct ip6_hdr *ip6, struct tcphdr **th)
 {
 
-	/* XXX-BZ we should check the flow-label. */
+	if (le) {
+		if (ip6->ip6_flow !=  le->le_ip6->ip6_flow)
+			return (TCP_LRO_CANNOT);
+	}
 
 	/* XXX-BZ We do not yet support ext. hdrs. */
 	if (ip6->ip6_nxt != IPPROTO_TCP)
@@ -597,7 +600,7 @@
 #ifdef INET6
 	case ETHERTYPE_IPV6:
 		l3hdr = ip6 = (struct ip6_hdr *)(eh + 1);
-		error = tcp_lro_rx_ipv6(lc, m, ip6, &th);
+		error = tcp_lro_rx_ipv6(lc, le, m, ip6, &th);
 		le->le_ip6 = ip6;
 		le->source_ip6 = ip6->ip6_src;
 		le->dest_ip6 = ip6->ip6_dst;
@@ -1173,7 +1176,7 @@
 		}
 		CURVNET_RESTORE();
 		l3hdr = ip6 = (struct ip6_hdr *)(eh + 1);
-		error = tcp_lro_rx_ipv6(lc, m, ip6, &th);
+		error = tcp_lro_rx_ipv6(lc, NULL, m, ip6, &th);
 		if (error != 0)
 			return (error);
 		tcp_data_len = ntohs(ip6->ip6_plen);