--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ dropafterack (challenge-ACK rate limiting, CVE-2016-5696 family)
+	static int tcp_ack_challenge_budget = 100;	/* per second */
+	SYSCTL_INT(_net_inet_tcp, OID_AUTO, ack_challenge_limit, CTLFLAG_RW,
+	    &tcp_ack_challenge_budget, 0, "DF-3294: max challenge ACKs/s");
 	...
 	m_freem(m);
 	tp->t_flags |= TF_ACKNOW;
+	if (!tcp_rate_limit_challenge_ack())	/* budget exhausted: drop */
+		return (IPPROTO_DONE);
 	tcp_output(tp);