the "redirect to localhost" bug


packet coming from the local host
replies in the rdr-to-localhost scenario

has the pseudo header csum
set by upper layers of the stack

pf rewrites
pf cannot know wether the packet has a pseudo hdr or a full cksum
it updates the checksum for any change it does