Index: sys/netinet/tcp_input.c
===================================================================
--- sys/netinet/tcp_input.c
+++ sys/netinet/tcp_input.c
@@ -2595,7 +2595,8 @@
 								    imax(1, tp->snd_nxt - tp->snd_una);
 							snd_cnt = howmany((long)tp->sackhint.prr_delivered *
 							    tp->snd_ssthresh, tp->sackhint.recover_fs) -
-							    tp->sackhint.sack_bytes_rexmit;
+							    (tp->sackhint.sack_bytes_rexmit +
+							    (tp->snd_nxt - tp->snd_recover));
 						} else {
 							if (V_tcp_do_prr_conservative)
 								limit = tp->sackhint.prr_delivered -
@@ -3969,7 +3970,8 @@
 			    imax(1, tp->snd_nxt - tp->snd_una);
 		snd_cnt = howmany((long)tp->sackhint.prr_delivered *
 			    tp->snd_ssthresh, tp->sackhint.recover_fs) -
-			    tp->sackhint.sack_bytes_rexmit;
+			    (tp->sackhint.sack_bytes_rexmit +
+			    (tp->snd_nxt - tp->snd_recover));
 	} else {
 		if (V_tcp_do_prr_conservative)
 			limit = tp->sackhint.prr_delivered -