Linux – Qemu: issues with bridged networking (Linux host, OpenBSD guest)

I have a computer running Linux.
It has qemu installed.
It has a bridge interface br0 configured with the following settings:

IP: 10.1.1.1
Netmask: 255.255.255.0

There is also a tap0 interface that is added to br0. tap0 is supposed to be used for networking guests running inside qemu.

I'm running Slax Linux from its LiveCD inside qemu like this:

qemu -kernel-kqemu \
 -net nic,vlan=0,macaddr=aa:aa:aa:aa:aa:aa,model=pcnet \
 -net tap,vlan=0,ifname=tap0,script=/etc/qemu-ifup \
 -m 512 \
 -cdrom slax-6.0.7.iso \
 1>stdout.log 2>stderr.log 

I'm booting Slax in text mode (don't need X, because my goal is to test networking). I'm configuring the network interface in the guest like this:

IP: 10.1.1.4
Netmask: 255.255.255.0
Gateway: 10.1.1.1 

Everything works well, I can ping in both directions:

10.1.1.1 -> 10.1.1.4
10.1.1.4 -> 10.1.1.1

Now I'm replacing the Slax LiveCD with a qemu image, that contains a freshly installed OpenBSD 4.5. I run it like this:

qemu -kernel-kqemu \
 -net nic,vlan=0,macaddr=aa:aa:aa:aa:aa:aa,model=pcnet \
 -net tap,vlan=0,ifname=tap0,script=/etc/qemu-ifup \
 -m 512 \
 -hda obsd.img \
 1>stdout.log 2>stderr.log 

OpenBSD boots, I'm configuring its network interface exactly the same way:

IP: 10.1.1.4
Netmask: 255.255.255.0
Gateway: 10.1.1.1

Now I can't ping in any direction.

The qemu logs don't contain any hints.

Also this is not a firewalling issue: OpenBSD 4.5 doesn't have pf enabled by default. Snippet from its /etc/rc.conf:

pf=NO # Packet filter / NAT