Patch originally in 2.6 from Rusty but updated in bk by marcello for 
ChangeSet@1.1136.71.52  2003-12-04 10:32:56-08:00  laforge@netfilter.org

Marcelo> Please try the updated 2.4 BK tree (you can use -bk5, 
Marcelo> http://www.kernel.org/pub/linux/kernel/v2.4/snapshots/patch-2.4.23-bk5.bz2).

Marcelo> It contains a fix for a known bug in the netfilter which
Marcelo> might what you're hitting.

--- linux-2.4.23/net/ipv4/netfilter/ip_fw_compat_masq.c.orig	Tue Dec  9 00:01:18 2003
+++ linux-2.4.23/net/ipv4/netfilter/ip_fw_compat_masq.c	Tue Dec  9 00:01:27 2003
@@ -91,9 +91,6 @@
 			WRITE_UNLOCK(&ip_nat_lock);
 			return ret;
 		}
-
-		place_in_hashes(ct, info);
-		info->initialized = 1;
 	} else
 		DEBUGP("Masquerading already done on this conn.\n");
 	WRITE_UNLOCK(&ip_nat_lock);