FreeBSD Security Advisory - ipfw maintains a pointer to layer 4 header information in the event that it needs to send a TCP reset or ICMP error message to discard packets. Due to incorrect handling of IP fragments, this pointer fails to get initialized.
b38cd8ef482c561df679f578513cab445b16a6b986a0729f301d0dc0adb15098