[*] DF-0473: installing CORRECTLY-SIZED rule (cmd_len=2) with cmd[0].module=0x80 opcode=0x80
[*] sopt_valsize after x_hdr strip = 48 (in [32,1020], passes DF-0472's cmd_len check)
[+] install OOB-index rule: rc=0 (rule installed)
[+] enabling firewall (net.inet.ip.fw3.enable=1)...
<<< ssh connection dies here: the firewall evaluates the OOB rule on the
    next outbound packet (the sysctl reply / ssh traffic), ip_fw3_chk does
    filter_funcs[0x80][0x80] -> entry 0x80*100+0x80 = 12928 (12828 past the
    1000-entry array) -> wild pointer call -> kernel panic. ssh times out. >>>

====================================================================
panic signature captured in dfbsd-qemu/boot.log (see panic.txt):
--------------------------------------------------------------------
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer     = 0x8:0xffffffff826001a4
current process         = Idle
Stopped at      ip_fw3_chk+0x1a4:       ret
db>
====================================================================

RIP 0xffffffff826001a4 == ipfw3.ko base (0xffffffff82600000) + 0x1a4, symbolised
by ddb as ip_fw3_chk+0x1a4 -- the (filter_funcs[cmd->module][cmd->opcode])(...)
indirect call site at sys/net/ipfw3/ip_fw3.c:506.  The wild call ran a few
instructions off the corrupted pointer and faulted on `ret`.

RUN_RC: ssh timed out (guest panicked & went down); vm.sh status => down.