=== DF-2592 fix validation: rebuild ipfw3.ko module (module-only, KERNBUILDDIR=warm obj) ===
Source: /usr/src/sys/net/ipfw3/ip_fw3_set.c with fix.diff applied (clamp sopt_valsize to sizeof(ctx->sets))
Command: cd /usr/src/sys/net/ipfw3 && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC

cc -O2 -pipe -D_KERNEL ... -c ip_fw3.c
cc -O2 -pipe -D_KERNEL ... -c ip_fw3_set.c
cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o ipfw3.ko ipfw3.o ip_fw3_set.o
MAKE_RC=0
-rw-r--r-- ipfw3.ko 38688 bytes

Patched ipfw3.ko sha256: f44f0a2aa38c4a4a0f581b1133f34f736c3e19eb55ed715703c41d297daf3ce5
Installed to /boot/kernel/ipfw3.ko; clean reboot (vm.sh down && vm.sh up) to load.
NOTE: kldunload of ipfw3_basic while the firewall is active triggers a SEPARATE panic
(rn_flush+0x1d, radix-tree teardown) unrelated to DF-2592; reboot avoids it.