Index: sys/netinet/tcp_input.c
===================================================================
--- sys/netinet/tcp_input.c
+++ sys/netinet/tcp_input.c
@@ -2600,10 +2600,12 @@
 						} else {
 							if (V_tcp_do_prr_conservative)
 								limit = tp->sackhint.prr_delivered -
-									tp->sackhint.sack_bytes_rexmit;
+									(tp->sackhint.sack_bytes_rexmit +
+									(tp->snd_nxt - tp->snd_recover));
 							else
 								limit = imax(tp->sackhint.prr_delivered -
-									    tp->sackhint.sack_bytes_rexmit,
+									    (tp->sackhint.sack_bytes_rexmit +
+									    (tp->snd_nxt - tp->snd_recover)),
 									    del_data) + maxseg;
 							snd_cnt = imin(tp->snd_ssthresh - pipe, limit);
 						}
@@ -3976,10 +3978,12 @@
 	} else {
 		if (V_tcp_do_prr_conservative)
 			limit = tp->sackhint.prr_delivered -
-			    tp->sackhint.sack_bytes_rexmit;
+			    (tp->sackhint.sack_bytes_rexmit +
+			    (tp->snd_nxt - tp->snd_recover));
 		else
 			limit = imax(tp->sackhint.prr_delivered -
-				    tp->sackhint.sack_bytes_rexmit,
+				    (tp->sackhint.sack_bytes_rexmit +
+				    (tp->snd_nxt - tp->snd_recover)),
 				    del_data) + maxseg;
 		snd_cnt = imin((tp->snd_ssthresh - pipe), limit);
 	}