Index: if_ethersubr.c
===================================================================
RCS file: /cvs/src/sys/net/if_ethersubr.c,v
retrieving revision 1.250
diff -u -p -r1.250 if_ethersubr.c
--- if_ethersubr.c	10 Jan 2018 00:14:38 -0000	1.250
+++ if_ethersubr.c	12 Jan 2018 07:07:32 -0000
@@ -326,17 +326,21 @@ ether_input(struct ifnet *ifp, struct mb
 	ac = (struct arpcom *)ifp;
 	eh = mtod(m, struct ether_header *);
 
-	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
+	/* Is the packet for us? */
+	if (memcmp(ac->ac_enaddr, eh->ether_dhost, ETHER_ADDR_LEN) != 0) {
+
+		/* If not, it must be multicast or broadcast to go further */
+		if (!ETHER_IS_MULTICAST(eh->ether_dhost))
+			goto dropanyway;
+
 		/*
 		 * If this is not a simplex interface, drop the packet
 		 * if it came from us.
 		 */
 		if ((ifp->if_flags & IFF_SIMPLEX) == 0) {
 			if (memcmp(ac->ac_enaddr, eh->ether_shost,
-			    ETHER_ADDR_LEN) == 0) {
-				m_freem(m);
-				return (1);
-			}
+			    ETHER_ADDR_LEN) == 0)
+				goto dropanyway;
 		}
 
 		if (memcmp(etherbroadcastaddr, eh->ether_dhost,
@@ -354,18 +358,6 @@ ether_input(struct ifnet *ifp, struct mb
 	if (m->m_flags & M_VLANTAG) {
 		m_freem(m);
 		return (1);
-	}
-
-	/*
-	 * If packet is unicast, make sure it is for us.  Drop otherwise.
-	 * This check is required in promiscous mode, and for some hypervisors
-	 * where the MAC filter is 'best effort' only.
-	 */
-	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
-		if (memcmp(ac->ac_enaddr, eh->ether_dhost, ETHER_ADDR_LEN)) {
-			m_freem(m);
-			return (1);
-		}
 	}
 
 	etype = ntohs(eh->ether_type);