pfSense

I've been able to reproduce it (with a floating rule so locally ordinated traffic hits the route-to rule).

The issue is fortunately fairly straightforward. When we route-to we tag the packet so that we still apply the route-to if the packet gets delayed and re-injected by dummynet. However, in many cases (e.g. there's no congestion) dummynet passes the packet through directly. In that case we process the route-to immediately, but we failed to clear the tag. That meant that when the packet came back to pf (after tunnelling by gif) we applied the route-to, and sent it back out the gif interface. This triggered the loop detection (happily, because without that we'd have panicked), and dropped the packet.

The following patch fixes it for me:

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 893a57965cc..bd3c9334efa 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -6581,9 +6581,11 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
                        md = m0;
                        error = pf_dummynet_route(pd, dir, s, r, ifp,
                            sintosa(&dst), &md);
-                       if (md != NULL)
+                       if (md != NULL) {
+                pd->pf_mtag->flags &= ~PF_TAG_ROUTE_TO;
                                error = (*ifp->if_output)(ifp, md,
                                    sintosa(&dst), NULL);
+            }
                } else
                        m_freem(m0);
        }
@@ -6786,8 +6788,10 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
        if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
                md = m0;
                pf_dummynet_route(pd, dir, s, r, ifp, sintosa(&dst), &md);
-               if (md != NULL)
+               if (md != NULL) {
+            pd->pf_mtag->flags &= ~PF_TAG_ROUTE_TO;
                        nd6_output_ifp(ifp, ifp, md, &dst, NULL);
+        }
        }
        else {
                in6_ifstat_inc(ifp, ifs6_in_toobig);

Tomorrow I'll see about writing a test case and landing the fix upstream and in our branched (with fixed whitespace, obviously).