This bug isn't present after I rebased to Linux 3.6-rc3. It looks like it's a bug was introduced in -rc2 by commit 63d02d157ec4124990258d66517b6c11fd6df0cf (net: tcp: ipv6_mapped needs sk_rx_dst_set method) and fixed by commit fae6ef87faeb8853896920c68ee703d715799d28 (net: tcp: move sk_rx_dst_set call after tcp_create_openreq_child())
This bug isn't present after I rebased to Linux 3.6-rc3. It looks like it's a bug was introduced in -rc2 by commit 63d02d157ec4124 990258d66517b6c 11fd6df0cf (net: tcp: ipv6_mapped needs sk_rx_dst_set method) and fixed by commit fae6ef87faeb885 3896920c68ee703 d715799d28 (net: tcp: move sk_rx_dst_set call after tcp_create_ openreq_ child() )