--- linux/VBoxNetFlt-linux.c	2009-05-29 20:36:47.000000000 +0200
+++ linux/VBoxNetFlt-linux.c	2009-06-09 10:15:31.000000000 +0200
@@ -27,6 +27,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/ip.h>
 
 #define LOG_GROUP LOG_GROUP_NET_FLT_DRV
 #include <VBox/log.h>
@@ -774,12 +775,29 @@
     else
     {
         if (pBuf->ip_summed == CHECKSUM_PARTIAL && pBuf->pkt_type == PACKET_OUTGOING)
+        {
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+            /*
+             * Try to work around the problem with CentOS 4.7 and 5.2 (2.6.9
+             * and 2.6.18 kernels), they pass wrong 'h' pointer down. We take IP
+             * header length from the header itself and reconstruct 'h' pointer
+             * to TCP (or whatever) header.
+             */
+            unsigned char *tmp = pBuf->h.raw;
+            if (pBuf->h.raw == pBuf->nh.raw && pBuf->protocol == htons(ETH_P_IP))
+                pBuf->h.raw = pBuf->nh.raw + pBuf->nh.iph->ihl * 4;
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) */
             if (VBOX_SKB_CHECKSUM_HELP(pBuf))
             {
                 LogRel(("VBoxNetFlt: Failed to compute checksum, dropping the packet.\n"));
                 dev_kfree_skb(pBuf);
                 return;
             }
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+            /* Restore the original (wrong) pointer. */
+            pBuf->h.raw = tmp;
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) */
+        }
         vboxNetFltLinuxForwardSegment(pThis, pBuf, fSrc);
     }
     /*
