diff --git a/tests/sys/netpfil/pf/sctp.py b/tests/sys/netpfil/pf/sctp.py
index 5e6dca5dd64..5db52dd993f 100644
--- a/tests/sys/netpfil/pf/sctp.py
+++ b/tests/sys/netpfil/pf/sctp.py
@@ -360,6 +360,37 @@ class TestSCTP(VnetTestTemplate):
         states = ToolsHelper.get_output("/sbin/pfctl -ss")
         assert re.search(r"all sctp 192.0.2.1:.*192.0.2.3:1234.*SHUTDOWN", states)
 
+
+    @pytest.mark.require_user("root")
+    def test_permutation(self):
+        # Test that we generate all permutations of src/dst addresses.
+        # Assign two addresses to each end, and check for the expected states
+        srv_vnet = self.vnet_map["vnet2"]
+
+        ifname = self.vnet_map["vnet1"].iface_alias_map["if1"].name
+        ToolsHelper.print_output("/sbin/ifconfig %s inet alias 192.0.2.4/24" % ifname)
+
+        ToolsHelper.print_output("/sbin/pfctl -e")
+        ToolsHelper.pf_rules([
+            "block proto sctp",
+            "pass inet proto sctp to 192.0.2.0/24"])
+
+        # Sanity check, we can communicate with the primary address.
+        client = SCTPClient("192.0.2.3", 1234)
+        client.send(b"hello", 0)
+        rcvd = self.wait_object(srv_vnet.pipe)
+        print(rcvd)
+        assert rcvd['ppid'] == 0
+        assert rcvd['data'] == "hello"
+
+        # Check that we have a state for 192.0.2.3 and 192.0.2.2 to 192.0.2.1, but also to 192.0.2.4
+        states = ToolsHelper.get_output("/sbin/pfctl -ss")
+        print(states)
+        assert re.search(r"all sctp 192.0.2.1:.*192.0.2.3:1234", states)
+        assert re.search(r"all sctp 192.0.2.1:.*192.0.2.2:1234", states)
+        assert re.search(r"all sctp 192.0.2.4:.*192.0.2.3:1234", states)
+        assert re.search(r"all sctp 192.0.2.4:.*192.0.2.2:1234", states)
+
 class TestSCTPv6(VnetTestTemplate):
     REQUIRED_MODULES = ["sctp", "pf"]
     TOPOLOGY = {
@@ -476,3 +507,33 @@ class TestSCTPv6(VnetTestTemplate):
         # Verify that the state is closing
         states = ToolsHelper.get_output("/sbin/pfctl -ss")
         assert re.search(r"all sctp 2001:db8::1\[.*2001:db8::3\[1234\].*SHUTDOWN", states)
+
+    @pytest.mark.require_user("root")
+    def test_permutation(self):
+        # Test that we generate all permutations of src/dst addresses.
+        # Assign two addresses to each end, and check for the expected states
+        srv_vnet = self.vnet_map["vnet2"]
+
+        ifname = self.vnet_map["vnet1"].iface_alias_map["if1"].name
+        ToolsHelper.print_output("/sbin/ifconfig %s inet6 alias 2001:db8::4/64" % ifname)
+
+        ToolsHelper.print_output("/sbin/pfctl -e")
+        ToolsHelper.pf_rules([
+            "block proto sctp",
+            "pass inet6 proto sctp to 2001:db8::0/64"])
+
+        # Sanity check, we can communicate with the primary address.
+        client = SCTPClient("2001:db8::3", 1234)
+        client.send(b"hello", 0)
+        rcvd = self.wait_object(srv_vnet.pipe)
+        print(rcvd)
+        assert rcvd['ppid'] == 0
+        assert rcvd['data'] == "hello"
+
+        # Check that we have a state for 2001:db8::3 and 2001:db8::2 to 2001:db8::1, but also to 2001:db8::4
+        states = ToolsHelper.get_output("/sbin/pfctl -ss")
+        print(states)
+        assert re.search(r"all sctp 2001:db8::1\[.*2001:db8::2\[1234\]", states)
+        assert re.search(r"all sctp 2001:db8::1\[.*2001:db8::3\[1234\]", states)
+        assert re.search(r"all sctp 2001:db8::4\[.*2001:db8::2\[1234\]", states)
+        assert re.search(r"all sctp 2001:db8::4\[.*2001:db8::3\[1234\]", states)