diff --git a/tests/sys/common/vnet.subr b/tests/sys/common/vnet.subr
index f9a9e9c428fd..590e8dea992e 100644
--- a/tests/sys/common/vnet.subr
+++ b/tests/sys/common/vnet.subr
@@ -1,66 +1,73 @@
 # $FreeBSD$
 # VNAT/jail utility functions
 ##
 
 vnet_init()
 {
 	if [ "`sysctl -i -n kern.features.vimage`" != 1 ]; then
 		atf_skip "This test requires VIMAGE"
 	fi
 }
 
 vnet_mkepair()
 {
 	ifname=$(ifconfig epair create)
 	echo $ifname >> created_interfaces.lst
 	echo ${ifname%a}b >> created_interfaces.lst
 	echo ${ifname%a}
 }
 
 vnet_mkbridge()
 {
 	ifname=$(ifconfig bridge create)
 	echo $ifname >> created_interfaces.lst
 	echo ${ifname}
 }
 
+vnet_mkvlan()
+{
+	ifname=$(ifconfig vlan create)
+	echo ${ifname} >> created_interfaces.lst
+	echo ${ifname}
+}
+
 vnet_mkloopback()
 {
 	ifname=$(ifconfig lo create)
 	echo $ifname >> created_interfaces.lst
 	echo ${ifname}
 }
 
 vnet_mkjail()
 {
 	jailname=$1
 	shift
 
 	vnet_interfaces=
 	for ifname in $@
 	do
 		vnet_interfaces="${vnet_interfaces} vnet.interface=${ifname}"
 	done
 	jail -c name=${jailname} persist vnet ${vnet_interfaces}
 
 	echo $jailname >> created_jails.lst
 }
 
 vnet_cleanup()
 {
 	if [ -f created_jails.lst ]; then
 		for jailname in `cat created_jails.lst`
 		do
 			jail -r ${jailname}
 		done
 		rm created_jails.lst
 	fi
 
 	if [ -f created_interfaces.lst ]; then
 		for ifname in `cat created_interfaces.lst`
 		do
 			ifconfig ${ifname} destroy
 		done
 		rm created_interfaces.lst
 	fi
 }
diff --git a/tests/sys/netpfil/pf/altq.sh b/tests/sys/netpfil/pf/altq.sh
index 294c01e9f8bd..53cf10e47565 100644
--- a/tests/sys/netpfil/pf/altq.sh
+++ b/tests/sys/netpfil/pf/altq.sh
@@ -1,94 +1,154 @@
 . $(atf_get_srcdir)/utils.subr
 
 atf_test_case "hfsc" "cleanup"
 hfsc_head()
 {
 	atf_set descr 'Basic HFSC test'
 	atf_set require.user root
 }
 
 hfsc_body()
 {
 	altq_init
 	is_altq_supported hfsc
 
 	epair=$(vnet_mkepair)
 	vnet_mkjail altq_hfsc ${epair}b
 
 	ifconfig ${epair}a 192.0.2.1/24 up
 	jexec altq_hfsc ifconfig ${epair}b 192.0.2.2/24 up
 
 	# Sanity check
 	atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2
 
 	jexec altq_hfsc pfctl -e
 	pft_set_rules altq_hfsc \
 	    "altq on ${epair}b bandwidth 100b hfsc queue { default }" \
 	    "queue default hfsc(default linkshare 80b)" \
 	    "pass proto icmp "
 
 	# single ping succeeds just fine
 	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
 
 	# "Saturate the link"
 	ping -i .1 -c 5 -s 1200 192.0.2.2
 
 	# We should now be hitting the limits and get this packet dropped.
 	atf_check -s exit:2 -o ignore ping -c 1 -s 1200 192.0.2.2
 }
 
 hfsc_cleanup()
 {
 	altq_cleanup
 }
 
 atf_test_case "match" "cleanup"
 match_head()
 {
 	atf_set descr 'Basic match keyword test'
 	atf_set require.user root
 }
 
 match_body()
 {
 	altq_init
 	is_altq_supported hfsc
 
 	epair=$(vnet_mkepair)
 	vnet_mkjail altq_match ${epair}b
 
 	ifconfig ${epair}a 192.0.2.1/24 up
 	jexec altq_match ifconfig ${epair}b 192.0.2.2/24 up
 
 	# Sanity check
 	atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2
 
 	jexec altq_match pfctl -e
 	pft_set_rules altq_match \
 	    "altq on ${epair}b bandwidth 100000000b hfsc queue { default, slow }" \
 	    "queue default hfsc(default linkshare 80000000b)" \
 	    "queue slow hfsc(linkshare 80b upperlimit 80b)" \
 	    "match proto icmp queue slow" \
 	    "pass"
 
 	# single ping succeeds just fine
 	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
 
 	# "Saturate the link"
 	ping -i .1 -c 5 -s 1200 192.0.2.2
 
 	# We should now be hitting the limits and get this packet dropped.
 	atf_check -s exit:2 -o ignore ping -c 1 -s 1200 192.0.2.2
 }
 
 match_cleanup()
 {
 	altq_cleanup
 }
 
+atf_test_case "cbq_vlan" "cleanup"
+cbq_vlan_head()
+{
+	atf_set descr 'CBQ over VLAN test'
+	atf_set require.user root
+}
+
+cbq_vlan_body()
+{
+	altq_init
+	is_altq_supported cbq
+
+	epair=$(vnet_mkepair)
+	vnet_mkjail altq_cbq_vlan ${epair}b
+
+	vlan=$(vnet_mkvlan)
+	ifconfig ${vlan} vlan 42 vlandev ${epair}a
+	ifconfig ${vlan} 192.0.2.1/24 up
+	ifconfig ${epair}a up
+
+	vlanj=$(jexec altq_cbq_vlan ifconfig vlan create)
+	echo ${vlanj} >> created_interfaces.lst
+
+	jexec altq_cbq_vlan ifconfig ${epair}b up
+	jexec altq_cbq_vlan ifconfig ${vlanj} vlan 42 vlandev ${epair}b
+	jexec altq_cbq_vlan ifconfig ${vlanj} 192.0.2.2/24 up
+
+	# Sanity check
+	atf_check -s exit:0 -o ignore ping -i .1 -c 3 -s 1200 192.0.2.2
+
+	jexec altq_cbq_vlan pfctl -e
+	pft_set_rules altq_cbq_vlan \
+		"altq on ${vlanj} bandwidth 14000b cbq queue { default }" \
+		"queue default bandwidth 14000b cbq(default) { slow } " \
+		"queue slow bandwidth 6000b cbq(borrow)" \
+		"match proto icmp queue slow" \
+		"match proto tcp queue default" \
+		"pass"
+
+	# single ping succeeds just fine
+	atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2
+
+	# "Saturate the link"
+	ping -i .01 -c 50 -s 1200 192.0.2.2
+
+	# We should now be hitting the limits and get these packet dropped.
+	rcv=$(ping -i .1 -c 5 -s 1200 192.0.2.2 | tr "," "\n" | awk '/packets received/ { print $1; }')
+	echo "Received $rcv packets"
+	if [ ${rcv} -gt 1 ]
+	then
+		atf_fail "Received ${rcv} packets in a saturated link"
+	fi
+}
+
+cbq_vlan_cleanup()
+{
+	altq_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "hfsc"
 	atf_add_test_case "match"
+	atf_add_test_case "cbq_vlan"
 }