Does it make sense to backport 3697649ff29e0f647565eed04b27a7779c646a22 from 4.6 to the longterm (4.4) release? I can trivially recreate the issue represented by 3697649ff29e0f647565eed04b27a7779c646a22 by attaching a eBPF filter that clones an ingress ICMP packet, and then tries to set the destination MAC address.
It seems like the patch applies cleanly to 4.4. I cherry-picked it, and rebuilt my kernel, and at least in the trivial test case passes.