I've got a patch which fixes the faulty checksums, and now ping works
with RR or TS set. I'm not quite sure, though, that it fixes the right
thing. I wonder if the problem is less that the checksum becomes wrong,
and more that the route and timestamps ought not to be changed by the
bridge interface.

Looks like your testcase:
- works in 2.6.36 and older
- crashes starting with 2.6.37 (-rc1), likely due to Bandan's commit 462fb2af9788a82 (bridge : Sanitize skb before it enters the IP stack) [1]
- crash fix is in 2.6.38.4, likely due to Eric's commit f8e9881c2aef1e9 (bridge: reset IPCB in br_parse_ip_options) [2]
- doesn't work post-crashfix



[1] http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=462fb2af9788a82a534f8184abfde31574e1cfa0
[2] http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f8e9881c2aef1e982e5abc25c046820cd0b7cf64