diff --git a/sys/dev/xen/netback/netback_unit_tests.c b/sys/dev/xen/netback/netback_unit_tests.c
--- a/sys/dev/xen/netback/netback_unit_tests.c
+++ b/sys/dev/xen/netback/netback_unit_tests.c
@@ -35,6 +35,10 @@
  */
 
 #include <sys/cdefs.h>
+#include <sys/socketvar.h>
+#include <netinet/in_pcb.h>
+#include <netinet/tcp_var.h>
+#include <netinet/tcp.h>
 /**
  * \file netback_unit_tests.c
  *
@@ -2311,9 +2315,8 @@
 	tcp->th_dport = htons(2222);
 	tcp->th_seq = htonl(0x00f72b10);
 	tcp->th_ack = htonl(0x7f37ba6c);
-	tcp->th_x2 = 0;
+	tcp_set_flags(tcp, TH_ACK | TH_PUSH);
 	tcp->th_off = 8;
-	tcp->th_flags = 0x18;
 	tcp->th_win = htons(0x410);
 	/* th_sum is incorrect; will be inserted by function under test */
 	tcp->th_sum = htons(0xbaad);
diff --git a/sys/netgraph/ng_nat.c b/sys/netgraph/ng_nat.c
--- a/sys/netgraph/ng_nat.c
+++ b/sys/netgraph/ng_nat.c
@@ -33,13 +33,16 @@
 #include <sys/malloc.h>
 #include <sys/ctype.h>
 #include <sys/errno.h>
+#include <sys/socket.h>
 #include <sys/syslog.h>
 
 #include <netinet/in_systm.h>
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/tcp.h>
+#include <netinet/tcp_var.h>
 #include <machine/in_cksum.h>
 
 #include <net/dlt.h>
@@ -862,9 +865,9 @@
 		 * doesn't have any idea about checksum offloading
 		 * in kernel. To workaround this, we do not do
 		 * checksumming in LibAlias, but only mark the
-		 * packets in th_x2 field. If we receive a marked
-		 * packet, we calculate correct checksum for it
-		 * aware of offloading.
+		 * packets with TH_RES1 in the th_x2 field. If we
+		 * receive a marked packet, we calculate correct
+		 * checksum for it aware of offloading.
 		 *
 		 * Why do I do such a terrible hack instead of
 		 * recalculating checksum for each packet?
@@ -875,10 +878,10 @@
 		 * has this problem, too.
 		 */
 
-		if (th->th_x2) {
+		if (tcp_get_flags(th) & TH_RES1) {
 			uint16_t ip_len = ntohs(ip->ip_len);
 
-			th->th_x2 = 0;
+			tcp_set_flags(th, tcp_get_flags(th) & ~TH_RES1);
 			th->th_sum = in_pseudo(ip->ip_src.s_addr,
 			    ip->ip_dst.s_addr, htons(IPPROTO_TCP +
 			    ip_len - (ip->ip_hl << 2)));
diff --git a/sys/netpfil/ipfilter/netinet/ip_compat.h b/sys/netpfil/ipfilter/netinet/ip_compat.h
--- a/sys/netpfil/ipfilter/netinet/ip_compat.h
+++ b/sys/netpfil/ipfilter/netinet/ip_compat.h
@@ -687,12 +687,6 @@
 #ifndef	IP_HL_A
 # define	IP_HL_A(x,y)	(x)->ip_hl = ((y) & 0xf)
 #endif
-#ifndef	TCP_X2
-# define	TCP_X2(x)	(x)->th_x2
-#endif
-#ifndef	TCP_X2_A
-# define	TCP_X2_A(x,y)	(x)->th_x2 = (y)
-#endif
 #ifndef	TCP_OFF
 # define	TCP_OFF(x)	(x)->th_off
 #endif
diff --git a/sys/netpfil/ipfilter/netinet/ip_fil_freebsd.c b/sys/netpfil/ipfilter/netinet/ip_fil_freebsd.c
--- a/sys/netpfil/ipfilter/netinet/ip_fil_freebsd.c
+++ b/sys/netpfil/ipfilter/netinet/ip_fil_freebsd.c
@@ -379,18 +379,17 @@
 	tcp2->th_sport = tcp->th_dport;
 	tcp2->th_dport = tcp->th_sport;
 
-	if (tcp->th_flags & TH_ACK) {
+	if (tcp_get_flags(tcp) & TH_ACK) {
 		tcp2->th_seq = tcp->th_ack;
-		tcp2->th_flags = TH_RST;
+		tcp_set_flags(tcp2, TH_RST);
 		tcp2->th_ack = 0;
 	} else {
 		tcp2->th_seq = 0;
 		tcp2->th_ack = ntohl(tcp->th_seq);
 		tcp2->th_ack += tlen;
 		tcp2->th_ack = htonl(tcp2->th_ack);
-		tcp2->th_flags = TH_RST|TH_ACK;
+		tcp_set_flags(tcp2, TH_RST|TH_ACK);
 	}
-	TCP_X2_A(tcp2, 0);
 	TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2);
 	tcp2->th_win = tcp->th_win;
 	tcp2->th_sum = 0;
diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -40,6 +40,7 @@
 #include <sys/mutex.h>
 #include <sys/refcount.h>
 #include <sys/socket.h>
+#include <sys/socketvar.h>
 
 #include <net/if.h>
 #include <net/vnet.h>
@@ -47,6 +48,7 @@
 #include <net/if_pflog.h>
 
 #include <netinet/in.h>
+#include <netinet/in_pcb.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet6/ip6_var.h>
@@ -54,6 +56,7 @@
 #include <netinet/tcp.h>
 #include <netinet/tcp_fsm.h>
 #include <netinet/tcp_seq.h>
+#include <netinet/tcp_var.h>
 #include <netinet/sctp_constants.h>
 #include <netinet/sctp_header.h>
 
@@ -1376,7 +1379,7 @@
 	struct tcphdr	*th = &pd->hdr.tcp;
 	int		 rewrite = 0;
 	u_short		 reason;
-	u_int8_t	 flags;
+	u_int16_t	 flags;
 	sa_family_t	 af = pd->af;
 	int		 srs;
 
@@ -1434,7 +1437,7 @@
 	if (rm && rm->rule_flag & PFRULE_REASSEMBLE_TCP)
 		pd->flags |= PFDESC_TCP_NORM;
 
-	flags = th->th_flags;
+	flags = tcp_get_flags(th);
 	if (flags & TH_SYN) {
 		/* Illegal packet */
 		if (flags & TH_RST)
@@ -1459,12 +1462,13 @@
 		goto tcp_drop;
 
 	/* If flags changed, or reserved data set, then adjust */
-	if (flags != th->th_flags || th->th_x2 != 0) {
+	if (flags != tcp_get_flags(th) ||
+	    (tcp_get_flags(th) & (TH_RES1|TH_RES2|TH_RES2)) != 0) {
 		u_int16_t	ov, nv;
 
 		ov = *(u_int16_t *)(&th->th_ack + 1);
-		th->th_flags = flags;
-		th->th_x2 = 0;
+		flags &= ~(TH_RES1 | TH_RES2 | TH_RES3);
+		tcp_set_flags(th, flags);
 		nv = *(u_int16_t *)(&th->th_ack + 1);
 
 		th->th_sum = pf_proto_cksum_fixup(m, th->th_sum, ov, nv, 0);