Same problem as with vlan(4). carp(4) also need to stop calling ether_input() directly and that implies having a mbuf with the correct Ethernet header prepended.
Index: netinet/ip_carp.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_carp.c,v retrieving revision 1.249 diff -u -p -r1.249 ip_carp.c --- netinet/ip_carp.c 7 Apr 2015 10:46:20 -0000 1.249 +++ netinet/ip_carp.c 9 Apr 2015 12:08:35 -0000 @@ -1434,11 +1434,15 @@ carp_our_mcastaddr(struct ifnet *ifp, u_ int carp_input(struct ifnet *ifp0, struct ether_header *eh0, struct mbuf *m) { - struct ether_header eh; + struct ether_header *eh; struct carp_if *cif = (struct carp_if *)ifp0->if_carp; struct ifnet *ifp; - memcpy(&eh, eh0, sizeof(eh)); + M_PREPEND(m, sizeof(*eh), M_DONTWAIT); + if (m == NULL) + return (-1); + eh = mtod(m, struct ether_header *); + memmove(eh, eh0, sizeof(*eh)); if ((ifp = carp_ourether(cif, eh0->ether_dhost))) ; @@ -1459,11 +1463,11 @@ carp_input(struct ifnet *ifp0, struct et m0->m_pkthdr.rcvif = &vh->sc_if; #if NBPFILTER > 0 if (vh->sc_if.if_bpf) - bpf_mtap_hdr(vh->sc_if.if_bpf, (char *)&eh, - ETHER_HDR_LEN, m0, BPF_DIRECTION_IN, NULL); + bpf_mtap_ether(vh->sc_if.if_bpf, m, + BPF_DIRECTION_IN); #endif vh->sc_if.if_ipackets++; - ether_input(m0, &eh); + ether_input_mbuf(&vh->sc_if, m0); } return (1); } @@ -1475,11 +1479,10 @@ carp_input(struct ifnet *ifp0, struct et #if NBPFILTER > 0 if (ifp->if_bpf) - bpf_mtap_hdr(ifp->if_bpf, (char *)&eh, ETHER_HDR_LEN, m, - BPF_DIRECTION_IN, NULL); + bpf_mtap_ether(ifp->if_bpf, m, BPF_DIRECTION_IN); #endif ifp->if_ipackets++; - ether_input(m, &eh); + ether_input_mbuf(ifp, m); return (0); }