Quoting "Jarek Poplawski" [off-list ref]:

These 2 patches aren't supposed to fix these problems:

- the __NET_XMIT_STOLEN patch fixes a problem when a qdiscs passed
  upwards NET_XMIT_SUCCESS when eg. an skb was stolen by an action,
  to prevent treating this as dropped; then the upper qdiscs couldn't
  tell it's not the full NET_XMIT_SUCCESS and counted it as queued,
  which was wrong. (BTW, I especially tried to do it with minimal
  changes in htb_enqueue() to let you apply your htb patch without
  much editing.)

- the __NET_XMIT_BYPASS actually doesn't fix any serious problem, but
  lets to remove the mapping from dev_queue_xmit(), and BTW it passes
  better information to upper qdiscs too.

This seems to also make sure that when returning 'full'  
NET_XMIT_SUCCESS, skb pointer is safe(r?) to use now.