DF-3400 — ipfw3 NAT delete leaks every nat_state2 (and icmp_in overwrite never frees)

What

sys/net/ipfw3_nat/ip_fw3_nat.c:806-842 (nat_del_dispatch): the loops that were supposed to free the per-alias nat_state2 entries (tcp_in[], udp_in[], icmp_in[]) are commented out — only the RB-tree nat_states are freed before kfree(alias)/kfree(nat):

/*
LIST_FOREACH_MUTABLE(s2, &nat->alias->icmp_in, next, tmp2) { ... }
*/

Every nat_state2 created while the NAT was active (one per flow per direction; up to 3 × 64511 per alias) is leaked on ipfw3 nat N delete / ipfw3 nat flush / module unload. The daily cleanup callout frees expired s2s only while the NAT still exists (:948-996); deleting the NAT first strands them all.

Additionally :326's store (alias->icmp_in[s->alias_port] = s2) overwrites any previous s2 at the same residue without freeing it (two internal hosts whose src*dst collide) — a slow steady leak even without deletes.

Impact

Kernel heap leak owned entirely by root configuration churn + traffic: add → traffic → delete cycles leak 28 B × states. Unbounded with repeated reconfiguration. Low severity (root-gated), certainty: certain from code; not verified on the guest (Low → Phase V skipped per contract).

Fix

Uncomment/rewrite the s2 free loops in nat_del_dispatch to walk alias->{tcp,udp,icmp}_in[] and kfree every non-NULL entry before freeing the alias, and free the displaced s2 when overwriting a non-NULL icmp_in slot at :326.