--- a/sys/net/gif/if_gif.c	2026-09-10 20:25:37.287365580 +0000
+++ b/sys/net/gif/if_gif.c	2026-09-10 20:25:45.927254056 +0000
@@ -465,6 +465,12 @@
 	IFNET_STAT_INC(ifp, ipackets, 1);
 	IFNET_STAT_INC(ifp, ibytes, m->m_pkthdr.len);
 	m->m_flags &= ~M_HASH;
+	/*
+	 * M_LENCHECKED was set for the OUTER packet; the inner packet's
+	 * header has not been characterized, so force ip_hashfn() to run
+	 * ip_lengthcheck() on it (DF-3321).
+	 */
+	m->m_flags &= ~M_LENCHECKED;
 	netisr_queue(isr, m);
 
 	return;
--- a/sys/net/ip_mroute/ip_mroute.c	2026-09-10 20:25:37.287365580 +0000
+++ b/sys/net/ip_mroute/ip_mroute.c	2026-09-10 20:25:45.927254056 +0000
@@ -1762,6 +1762,11 @@
     m->m_pkthdr.len -= sizeof(struct ip);
     m->m_pkthdr.rcvif = last_encap_vif->v_ifp;
 
+    /*
+     * The outer packet's hash/length-check state does not apply to the
+     * decapsulated inner packet (DF-3321).
+     */
+    m->m_flags &= ~(M_HASH | M_LENCHECKED);
     netisr_queue(NETISR_IP, m);
     return(IPPROTO_DONE);
 }
--- a/sys/netproto/mpls/mpls_input.c	2026-09-10 20:25:37.287365580 +0000
+++ b/sys/netproto/mpls/mpls_input.c	2026-09-10 20:25:45.927254056 +0000
@@ -117,6 +117,11 @@
 		if (MPLS_STACK(ntohl(mpls->mpls_shim))) {
 			/* Decapsulate the ip datagram from the mpls frame. */
 			m_adj(m, sizeof(struct mpls));
+			/*
+			 * The ethernet-frame hash no longer applies and the
+			 * inner IP header has not been length-checked (DF-3321).
+			 */
+			m->m_flags &= ~(M_HASH | M_LENCHECKED);
 			netisr_queue(NETISR_IP, m);
 			return;
 		}
@@ -136,6 +141,8 @@
 		if (MPLS_STACK(ntohl(mpls->mpls_shim))) {
 			/* Decapsulate the ip datagram from the mpls frame. */
 			m_adj(m, sizeof(struct mpls));
+			/* See the IPv4 Explicit NULL label above (DF-3321). */
+			m->m_flags &= ~(M_HASH | M_LENCHECKED);
 			netisr_queue(NETISR_IPV6, m);
 			return;
 		}