Index: linux-4.1.52/net/bridge/netfilter/ebt_vlan.c
===================================================================
--- linux-4.1.52.orig/net/bridge/netfilter/ebt_vlan.c	2018-01-22 14:21:12.865630793 +0800
+++ linux-4.1.52/net/bridge/netfilter/ebt_vlan.c	2018-01-22 16:51:49.597849589 +0800
@@ -43,6 +43,34 @@
 	unsigned short id;	/* VLAN ID, given from frame TCI */
 	unsigned char prio;	/* user_priority, given from frame TCI */
 	/* VLAN encapsulated Type/Length field, given from orig frame */
+#if 1 /* ZyXEL QoS, John (porting from MSTC) */
+	__be16 encap = 0;
+	const struct vlan_hdr *fp;
+	struct vlan_hdr _frame;
+
+    if(ntohs(((struct vlan_hdr *)(skb->vlan_header))->h_vlan_encapsulated_proto) == 0){
+	fp = skb_header_pointer(skb, 0, sizeof(_frame), &_frame);
+	if (fp == NULL)
+		return false;
+
+	/* Tag Control Information (TCI) consists of the following elements:
+	 * - User_priority. The user_priority field is three bits in length,
+	 * interpreted as a binary number.
+	 * - Canonical Format Indicator (CFI). The Canonical Format Indicator
+	 * (CFI) is a single bit flag value. Currently ignored.
+	 * - VLAN Identifier (VID). The VID is encoded as
+	 * an unsigned binary number. */
+	TCI = ntohs(fp->h_vlan_TCI);
+	id = TCI & VLAN_VID_MASK;
+	prio = (TCI >> 13) & 0x7;
+	encap = fp->h_vlan_encapsulated_proto;
+    }else{
+        // for new broadcom vlan device
+        TCI = ntohs(((struct vlan_hdr *)(skb->vlan_header))->h_vlan_TCI);
+	    id = TCI & VLAN_VID_MASK;
+	    prio = (TCI >> 13) & 0x7;
+    }
+#else
 	__be16 encap;
 
 	if (skb_vlan_tag_present(skb)) {
@@ -69,7 +97,7 @@
 	 * an unsigned binary number. */
 	id = TCI & VLAN_VID_MASK;
 	prio = (TCI >> 13) & 0x7;
-
+#endif
 	/* Checking VLAN Identifier (VID) */
 	if (GET_BITMASK(EBT_VLAN_ID))
 		EXIT_ON_MISMATCH(id, EBT_VLAN_ID);