diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -330,6 +330,7 @@
 			    __func__, off));
 			sack_rxmit = 1;
 			sendalot = 1;
+			len = min(len, 4 * tp->t_maxseg)
 			TCPSTAT_INC(tcps_sack_rexmits);
 			TCPSTAT_ADD(tcps_sack_rexmit_bytes,
 			    min(len, tcp_maxseg(tp)));
@@ -554,11 +555,14 @@
 	ipoptlen += ipsec_optlen;
 #endif
 
-	if ((tp->t_flags & TF_TSO) && V_tcp_do_tso && len > tp->t_maxseg &&
+	if ((len > tp->t_maxseg) &&
+	    (tp->t_flags & TF_TSO) &&
+	    V_tcp_do_tso &&
 	    (tp->t_port == 0) &&
-	    ((tp->t_flags & TF_SIGNATURE) == 0) &&
-	    tp->rcv_numsacks == 0 && sack_rxmit == 0 &&
-	    ipoptlen == 0 && !(flags & TH_SYN))
+	    !(tp->t_flags & TF_SIGNATURE) &&
+	    (tp->rcv_numsacks == 0) &&
+	    (ipoptlen == 0) &&
+	    !(flags & TH_SYN))
 		tso = 1;
 
 	if (sack_rxmit) {