diff --git a/target/linux/generic/patches-3.10/611-netfilter_match_bypass_default_table.patch b/target/linux/generic/patches-3.10/611-netfilter_match_bypass_default_table.patch
index 3cf0e5a32d9f21a5e5d38da41e5d70e09e918f95..2e0324345be275603f38d67611f60a85740f8556 100644
--- a/target/linux/generic/patches-3.10/611-netfilter_match_bypass_default_table.patch
+++ b/target/linux/generic/patches-3.10/611-netfilter_match_bypass_default_table.patch
@@ -34,33 +34,35 @@
  /* Returns one of the generic firewall policies, like NF_ACCEPT. */
  unsigned int
  ipt_do_table(struct sk_buff *skb,
-@@ -334,6 +361,25 @@ ipt_do_table(struct sk_buff *skb,
- 	ip = ip_hdr(skb);
- 	indev = in ? in->name : nulldevname;
- 	outdev = out ? out->name : nulldevname;
-+
+@@ -331,9 +358,27 @@ ipt_do_table(struct sk_buff *skb,
+ 	unsigned int addend;
+ 
+ 	/* Initialization */
 +	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 +	local_bh_disable();
-+	addend = xt_write_recseq_begin();
 +	private = table->private;
 +	cpu        = smp_processor_id();
 +	table_base = private->entries[cpu];
-+	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
-+	stackptr   = per_cpu_ptr(private->stackptr, cpu);
-+	origptr    = *stackptr;
-+
 +	e = get_entry(table_base, private->hook_entry[hook]);
 +	if (ipt_handle_default_rule(e, &verdict)) {
 +		ADD_COUNTER(e->counters, skb->len, 1);
-+		xt_write_recseq_end(addend);
 +		local_bh_enable();
 +		return verdict;
 +	}
++
+ 	ip = ip_hdr(skb);
+ 	indev = in ? in->name : nulldevname;
+ 	outdev = out ? out->name : nulldevname;
++
++	addend = xt_write_recseq_begin();
++	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
++	stackptr   = per_cpu_ptr(private->stackptr, cpu);
++	origptr    = *stackptr;
 +
  	/* We handle fragments by dealing with the first fragment as
  	 * if it was a normal packet.  All other fragments are treated
  	 * normally, except that they will NEVER match rules that ask
-@@ -348,18 +394,6 @@ ipt_do_table(struct sk_buff *skb,
+@@ -348,18 +393,6 @@ ipt_do_table(struct sk_buff *skb,
  	acpar.family  = NFPROTO_IPV4;
  	acpar.hooknum = hook;