DF-3268 run — guest DragonFly dfbsd 6.5-DEVELOPMENT #1 (detector kernel),
6 vCPU, pf.ko loaded, ruleset: synproxy.conf (pass quick tcp to
127.0.0.2:8080 synproxy state; pass all [implicit keep state]).

$ pfctl -si | grep "current entries"     # before
  current entries                       494
$ /root/poc/grow_states 90 &
$ sleep 20; pfctl -si | grep -E "current entries|state-limit"; vmstat -m | grep pfstatepl
  current entries                     32527
  state-limit                            0            0.0/s
          pfstatepl   31.8K    9.93M       0    390M    20.7M
$ sleep 40; pfctl -si | grep -E "current entries|state-limit"; vmstat -m | grep -E "pfstatepl|pfstatekeypl|pfstateitempl"
  current entries                     55235
  state-limit                            0            0.0/s
          pfstatepl   53.9K   16.9M       0    390M    20.8M
       pfstatekeypl   53.0K    5.38M       0    390M    20.8M
      pfstateitempl   53.0K    1.24M       0    390M    20.8M
$ sleep 35; pkill grow_states; sleep 2
  current entries                     48391
  state-limit                            0            0.0/s
          pfstatepl   47.3K   14.8M       0    390M    20.9M
$ tail -1 /tmp/grow.log
done: 1843200 distinct SYNs

PFSTATE_HIWAT (pfvar.h:703) = 50000. Table peaked at 55235 states
(past the hard limit) with the state-limit counter never incremented:
the DIOCSETLIMIT/PFSTATE_HIWAT limit is not enforced anywhere on the
creation path (pf_create_state pf.c:4112 checks only per-rule
max_states; pf_pool_limits referenced solely by ioctl plumbing).
Total footprint at peak: 16.9M (states) + 5.38M (keys) + 1.24M (items)
= ~23.5 MB for 55K states (~430 B/state); scales linearly with attack
rate; adaptive timeouts (start 30000/end 60000) are the only brake and
are admin-disableable.