Index: sys/netinet/tcp_input.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/tcp_input.c,v
retrieving revision 1.305
diff -u -p -r1.305 tcp_input.c
--- sys/netinet/tcp_input.c	26 May 2010 17:38:29 -0000	1.305
+++ sys/netinet/tcp_input.c	24 Nov 2010 12:58:23 -0000
@@ -2277,8 +2277,8 @@ after_listen:
 	 */
 	if (tiflags & TH_SYN) {
 		if (tp->rcv_nxt == th->th_seq) {
-			tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
-			    TH_ACK);
+			tcp_respond(tp, mtod(m, void *), m, th,
+			    (tcp_seq)0, th->th_ack - 1, TH_ACK);
 			if (tcp_saveti)
 				m_freem(tcp_saveti);
 			return;
@@ -2820,12 +2820,13 @@ dropwithreset:
 	}
 
 	if (tiflags & TH_ACK)
-		(void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
+		(void)tcp_respond(tp, mtod(m, void *), m, th,
+		    (tcp_seq)0, th->th_ack, TH_RST);
 	else {
 		if (tiflags & TH_SYN)
 			tlen++;
-		(void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
-		    TH_RST|TH_ACK);
+		(void)tcp_respond(tp, mtod(m, void *), m, th,
+		    th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK);
 	}
 	if (tcp_saveti)
 		m_freem(tcp_saveti);
@@ -3917,7 +3918,8 @@ syn_cache_get(struct sockaddr *src, stru
 	return (so);
 
 resetandabort:
-	(void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
+	(void)tcp_respond(NULL, mtod(m, void *), m, th,
+	    (tcp_seq)0, th->th_ack, TH_RST);
 abort:
 	if (so != NULL) {
 		(void) soqremque(so, 1);
Index: sys/netinet/tcp_subr.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/tcp_subr.c,v
retrieving revision 1.238
diff -u -p -r1.238 tcp_subr.c
--- sys/netinet/tcp_subr.c	16 Sep 2009 15:23:05 -0000	1.238
+++ sys/netinet/tcp_subr.c	24 Nov 2010 12:58:23 -0000
@@ -600,7 +600,7 @@ tcp_template(struct tcpcb *tp)
  * segment are as specified by the parameters.
  */
 int
-tcp_respond(struct tcpcb *tp, struct mbuf *template, struct mbuf *m,
+tcp_respond(struct tcpcb *tp, void *template, struct mbuf *m,
     struct tcphdr *th0, tcp_seq ack, tcp_seq seq, int flags)
 {
 #ifdef INET6
@@ -642,7 +642,7 @@ tcp_respond(struct tcpcb *tp, struct mbu
 			return EINVAL;
 
 		/* get family information from template */
-		switch (mtod(template, struct ip *)->ip_v) {
+		switch (((struct ip *)(template))->ip_v) {
 		case 4:
 			family = AF_INET;
 			hlen = sizeof(struct ip);
@@ -675,17 +675,17 @@ tcp_respond(struct tcpcb *tp, struct mbu
 			tlen = 0;
 
 		m->m_data += max_linkhdr;
-		bcopy(mtod(template, void *), mtod(m, void *),
-			template->m_len);
 		switch (family) {
 		case AF_INET:
 			ip = mtod(m, struct ip *);
 			th = (struct tcphdr *)(ip + 1);
+			memcpy(ip, template, sizeof(*ip));
 			break;
 #ifdef INET6
 		case AF_INET6:
 			ip6 = mtod(m, struct ip6_hdr *);
 			th = (struct tcphdr *)(ip6 + 1);
+			memcpy(ip6, template, sizeof(*ip6));
 			break;
 #endif
 #if 0
Index: sys/netinet/tcp_timer.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/tcp_timer.c,v
retrieving revision 1.84
diff -u -p -r1.84 tcp_timer.c
--- sys/netinet/tcp_timer.c	10 Nov 2008 01:06:43 -0000	1.84
+++ sys/netinet/tcp_timer.c	24 Nov 2010 12:58:23 -0000
@@ -559,11 +559,11 @@ tcp_timer_keep(void *arg)
 			 * The keepalive packet must have nonzero
 			 * length to get a 4.2 host to respond.
 			 */
-			(void)tcp_respond(tp, tp->t_template,
+			(void)tcp_respond(tp, mtod(tp->t_template, void *),
 			    (struct mbuf *)NULL, NULL, tp->rcv_nxt - 1,
 			    tp->snd_una - 1, 0);
 		} else {
-			(void)tcp_respond(tp, tp->t_template,
+			(void)tcp_respond(tp, mtod(tp->t_template, void *),
 			    (struct mbuf *)NULL, NULL, tp->rcv_nxt,
 			    tp->snd_una - 1, 0);
 		}
Index: sys/netinet/tcp_var.h
===================================================================
RCS file: /cvsroot/src/sys/netinet/tcp_var.h,v
retrieving revision 1.162
diff -u -p -r1.162 tcp_var.h
--- sys/netinet/tcp_var.h	16 Sep 2009 15:23:05 -0000	1.162
+++ sys/netinet/tcp_var.h	24 Nov 2010 12:58:23 -0000
@@ -867,7 +867,7 @@ void	tcpipqent_init(void);
 struct ipqent *tcpipqent_alloc(void);
 void	 tcpipqent_free(struct ipqent *);
 
-int	 tcp_respond(struct tcpcb *, struct mbuf *, struct mbuf *,
+int	 tcp_respond(struct tcpcb *, void *, struct mbuf *,
 	    struct tcphdr *, tcp_seq, tcp_seq, int);
 void	 tcp_rmx_rtt(struct tcpcb *);
 void	 tcp_setpersist(struct tcpcb *);