it goes back to the port that sent it, which is always on the gateway
machine, which corresponds to a file in /net/icmp/ on the gateway
but if another node has imported that, and that node did the ping,
it's something like this:

	node imports /net from gateway (import(4) dials exportfs(4) service on gateway)
				gateway starts a gateway.exportfs serving 9P
	...
	node opens imported /net/icmp/clone
		9P:
		Topen -> gateway.exportfs
				exportfs opens appropriate file on gateway
		Ropen <- gateway.exportfs
	node writes to the opened file
		Twrite -> gateway.exportfs
			gateway.exportfs does the write to the file on gateway
				gateway.IPstack -> ICMP packet on net on port P
		Rwrite <- gateway.exportfs
				gateway.IPstack <- ICMP responses, queued for port P's file
	...
	node reads opened file
		Tread -> gateway.exportfs
				gateway.exportfs does the read of file on gateway
		Rread <- gateway.exportfs (with data for port P's file)
	...
where the T- and R-messages are 9P messages on the channel set up by import(4) between
node and the exportfs(4) on the gateway, assuming the gateway
provides that service (see listen(8)).   the kernel doesn't do anything special,
which is indeed the point, so reading the kernel code wouldn't be particularly helpful.
man 4 import, man 4 exportfs, and man 3 ip would be more helpful.