--- sys/net/ipfw3/ip_fw3.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fixsrc/sys/net/ipfw3/ip_fw3.c	2026-10-24 13:16:53.327777190 +0000
@@ -397,7 +397,10 @@
 				src_port = udp->uh_sport;
 				break;
 			case IPPROTO_ICMP:
-				PULLUP_TO(hlen + 4);
+				/* DF-2577 fix: icmp_id lives at hlen+4..hlen+5;
+				 * only hlen+4 was pulled up (2-byte backing
+				 * store over-read on short ICMP). */
+				PULLUP_TO(hlen + 8);
 				icmp = L3HDR(struct icmp, ip);
   				args->f_id.flags = icmp->icmp_type;
 				dst_port = icmp->icmp_id;