Index: head/sys/dev/sfxge/sfxge_rx.c
===================================================================
--- head/sys/dev/sfxge/sfxge_rx.c
+++ head/sys/dev/sfxge/sfxge_rx.c
@@ -688,15 +688,18 @@
 	 */
 	if (l3_proto == htons(ETHERTYPE_IP)) {
 		struct ip *iph = nh;
-		if ((iph->ip_p - IPPROTO_TCP) |
-		    (iph->ip_hl - (sizeof(*iph) >> 2u)) |
+
+		KASSERT(iph->ip_p == IPPROTO_TCP,
+		    ("IPv4 protocol is not TCP, but packet marker is set"));
+		if ((iph->ip_hl - (sizeof(*iph) >> 2u)) |
 		    (iph->ip_off & htons(IP_MF | IP_OFFMASK)))
 			goto deliver_now;
 		th = (struct tcphdr *)(iph + 1);
 	} else if (l3_proto == htons(ETHERTYPE_IPV6)) {
 		struct ip6_hdr *iph = nh;
-		if (iph->ip6_nxt != IPPROTO_TCP)
-			goto deliver_now;
+
+		KASSERT(iph->ip6_nxt == IPPROTO_TCP,
+		    ("IPv6 next header is not TCP, but packet marker is set"));
 		l2_id |= SFXGE_LRO_L2_ID_IPV6;
 		th = (struct tcphdr *)(iph + 1);
 	} else {
@@ -841,7 +844,9 @@
 
 		/* Pass packet up the stack or into LRO (pipelined) */
 		if (prev != NULL) {
-			if (lro_enabled)
+			if (lro_enabled &&
+			    ((prev->flags & (EFX_PKT_TCP | EFX_CKSUM_TCPUDP)) ==
+			     (EFX_PKT_TCP | EFX_CKSUM_TCPUDP)))
 				sfxge_lro(rxq, prev);
 			else
 				sfxge_rx_deliver(sc, prev);
@@ -860,7 +865,9 @@
 
 	/* Pass last packet up the stack or into LRO */
 	if (prev != NULL) {
-		if (lro_enabled)
+		if (lro_enabled &&
+		    ((prev->flags & (EFX_PKT_TCP | EFX_CKSUM_TCPUDP)) ==
+		     (EFX_PKT_TCP | EFX_CKSUM_TCPUDP)))
 			sfxge_lro(rxq, prev);
 		else
 			sfxge_rx_deliver(sc, prev);