DF-3434 - ipfw3 check_keep_state() limit-type keep-state rules
================================================================

1. setup (fwsetup portion): kldload ipfw3 ipfw3_basic (NOTE: loading ipfw3
   engages 'default to deny' instantly - the allow rules must be installed
   from a pre-staged nohup script; see fwsetup.sh), then
     ipfw3 add 00099 allow udp from any to any keep-state limit src-port 100
     ipfw3 add 00100 allow ip from any to any
2. build:  cc -O2 -o /tmp/state_oops /tmp/state_oops.c
3. trigger (unprivileged): /tmp/state_oops 20   then /tmp/state_oops 300
4. observed (stock INVARIANTS kernel #0, 2026-09-12):
     after 20 identical udp packets:  dmesg | grep -c oops  -> 38
     after 300 more:                                     -> 638
     M_IPFW3_STATE inuse: 46 -> 646  (+600 = one leaked 64B state per
     duplicate rule evaluation; two evaluations per loopback packet)
     ipfw3 show:
       00099 250360 9018080 allow udp keep-state limit src-port 100
   Root cause: ip_fw3_state.c:296-316 - for cmd->arg3 != 0 ('limit'
   rules) the RB_FIND de-dup is skipped, so every packet of an already
   tracked flow re-allocates at :319 and RB_INSERT at :327 returns the
   existing node; the code just kprintf("oops\n") at :328 and LEAKS the
   fresh allocation. Console kprintf per packet = serial-console flood
   amplification; leak is bounded per tree only by the never-decremented
   count gate (DF-0632).