You can patch the kernel. I can't really remember if that flag is in the 4.0D, but I have used it on 4.0F alot.
If the first dbx line fails, 4.0D does not have a rejectcodemask. In the second dbx you enable the filter and in the third you modify the kernel so that it should be there after a reboot. But please check to be shure!
# dbx -k /vmunix
(dbx) p icmp_rejectcodemask
0
(dbx) assign icmp_rejectcodemask=0x20
32
(dbx) patch icmp_rejectcodemask=0x20
32
(dbx) q