-- root installs a DENY-v6 policy for documentation: default deny already active
65535          0          0 deny ipv6 from any to any
-- nobody adds ACCEPT-any rule #1 --
IPV6_FW_ADD: ACCEPT-any rule #1 added, uid=65534, ret=0
-- authoritative view via /sbin/ip6fw (root): the nobody-added rule is live in the kernel chain --
00001          0          0 allow ipv6 from any to any
65535          0          0 deny ipv6 from any to any
-- and nobody can also install a #1 DENY (unpriv firewall DoS): flush first --
IPV6_FW_FLUSH: chain flushed (default kept), ret=0