diff --git a/qemu-fix-vnet-hdr-slirp-bustage.patch b/qemu-fix-vnet-hdr-slirp-bustage.patch
new file mode 100644
index 0000000..e647b24
--- /dev/null
+++ b/qemu-fix-vnet-hdr-slirp-bustage.patch
@@ -0,0 +1,47 @@
+From 97064ad88123744056d141e96247348dd2d9621c Mon Sep 17 00:00:00 2001
+From: Mark McLoughlin <markmc@redhat.com>
+Date: Fri, 7 Aug 2009 09:39:51 +0100
+Subject: [PATCH] net: fix vnet_hdr bustage with slirp
+
+slirp has started using VLANClientState::opaque and this has caused the
+kvm specific tap_has_vnet_hdr() hack to break because we blindly use
+this opaque pointer even if it is not a tap client.
+
+Add yet another hack to check that we're actually getting called with a
+tap client.
+
+[Needed on stable-0.11 too]
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Fedora-patch: qemu-fix-vnet-hdr-slirp-bustage.patch
+---
+ net.c |    6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/net.c b/net.c
+index c7702f8..2428f63 100644
+--- a/net.c
++++ b/net.c
+@@ -1521,6 +1521,9 @@ int tap_has_vnet_hdr(void *opaque)
+     VLANClientState *vc = opaque;
+     TAPState *s = vc->opaque;
+ 
++    if (vc->receive != tap_receive)
++        return 0;
++
+     return s ? s->has_vnet_hdr : 0;
+ }
+ 
+@@ -1529,6 +1532,9 @@ void tap_using_vnet_hdr(void *opaque, int using_vnet_hdr)
+     VLANClientState *vc = opaque;
+     TAPState *s = vc->opaque;
+ 
++    if (vc->receive != tap_receive)
++        return;
++
+     if (!s || !s->has_vnet_hdr)
+         return;
+ 
+-- 
+1.6.2.5
+
diff --git a/qemu.spec b/qemu.spec
index 83fc672..a1dbb0c 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -4,7 +4,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.10.91
-Release: 0.4.%{kvmvertag}%{?dist}
+Release: 0.5.%{kvmvertag}%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -31,6 +31,9 @@ Patch04: qemu-add-ksm-support.patch
 # Fix extboot checksum (bug #514899)
 Patch05: qemu-fix-extboot-signrom.patch
 
+# Fix virtio_net with -net user (bug #516022)
+Patch06: qemu-fix-vnet-hdr-slirp-bustage.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
 BuildRequires: rsync dev86 iasl
@@ -216,6 +219,7 @@ such as kvmtrace and kvm_stat.
 %patch03 -p1
 %patch04 -p1
 %patch05 -p1
+%patch06 -p1
 
 %build
 # systems like rhel build system does not have a recent enough linker so
@@ -480,6 +484,9 @@ getent passwd qemu >/dev/null || \
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Fri Aug  7 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.5.rc1
+- Fix virtio_net with -net user (#516022)
+
 * Tue Aug  4 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.4.rc1
 - Update to qemu-kvm-0.11-rc1; no changes from rc1-rc0