=== Patched kernel/module (#0 kernel + rebuilt ipfw3_nat.ko) ===
$ kldload ipfw3 && kldload ipfw3_basic && kldload ipfw3_nat
$ ipfw3 nat 1 config ip 10.0.2.15
$ ipfw3 add 100 nat 1 ip from any to 10.0.3.5 out
$ ipfw3 add 200 allow ip from any to any
$ ipfw3 show
00100  0     0 nat 1 to 10.0.3.5 out
00200 59 11596 allow
65535  1   108 deny

$ /root/raw_trigger
[*] DF-0571 raw trigger: sending IP packet with proto=132 (SCTP)
[+] sendto returned -1 (errno=13: Permission denied)
EXIT=0

$ ipfw3 show
00100  1    32 nat 1 to 10.0.3.5 out    <-- rule matched (counter 1)
00200 70 12616 allow
65535  1   108 deny
$ uptime
11:26PM  up 31 secs, 0 users, load averages: 0.16, 0.04, 0.02    <-- no panic