DF-0633: ipfw3 cross-CPU RB-traversal race

Driver is the shell script df0633_test.sh which:
  1. loads ipfw3 + ipfw3_basic, adds a keep-state rule
  2. spawns N background ping generators to mutate state trees
     on all CPUs (each ping with a unique dst IP creates a new state)
  3. in the foreground, runs 'ipfw3 state show' 500+ times,
     each call entering ip_fw3_ctl_state_get on CPU 0 and walking
     every other CPU's RB trees with no synchronization

Race outcomes (probabilistic; non-deterministic):
  - panic following a stale rb_node pointer into freed memory
  - UAF read when a node is freed mid-traversal
  - infinite loop soft-locking netisr 0

On a 6-CPU SMP guest, the race is real but hard to trigger
deterministically. The bug is confirmed in source (see VERDICT.md)
and the proper fix is in fix.diff (per-CPU netmsg dispatch).