== fix-v2 (kernel #2, attempt 1: callout_terminate + state NULL guard only) ==
bounce loop PANICKED with identical rn_flush signature (fix insufficient: table/basic lifecycle unfixed)

== fix-v3 (kernel #1 16:56:02, fix.diff v2) ==
bounce done: 4000 cycles, no panic

oops check after 320 dup packets: 0 lines; M_IPFW3_STATE inuse 6 (flat)