I think I've found the problem. when a packet comes from ral0 ---> 10.0.0.1, the bridge changes the received interface to vr0, which has IFCAP_CSUM_IPv4.
So when the icmp layer is about to test the checksum, it assumes the output interface is the same one which the packet came in (in our case, vr0, and not ral0). So the checksum does not get calculated. That's why it works when we remove the capabilities from vr0.
