Summary

In ip_fw3_ctl(), every sub-handler's return value is assigned to error except the IP_FW_X case, which calls ip_fw3_ctl_x(sopt) and discards its return. ip_fw3_ctl_x rewrites sopt_name to the payload opcode and re-enters ip_fw3_ctl; when that inner dispatch fails (e.g. an IP_FW_ADD rejected by the size check, or IP_FW_ZERO returning EINVAL), the failure propagates up to ip_fw3_ctl_x but is dropped, so setsockopt returns 0 and the ipfw3 CLI prints success for a rule that was not installed. Root-only (raw socket). A firewall administrator using IP_FW_X gets a success acknowledgement for operations that silently failed - a security policy (deny rule, state delete, table append) may be believed active while it was never installed: policy-integrity/correctness hazard. Info hardening; not verified. Fix: 'error = ip_fw3_ctl_x(sopt);' like every sibling case. [VERIFIED pass2: reproduced - nested IP_FW_X payload opcode returns 0 while kernel logs inner EINVAL; fixed module returns minus-1 EINVAL A/B]