ipfw nat befuddlement

[Randy Bush]

i386 current

# grep -n nat /etc/ipfw.rules
33:add nat 42 all from any to any
34:add nat 42 config if vr0 same_ports unreg_only

# ipfw -q /etc/ipfw.rules
Line 33: getsockopt(IP_FW_ADD): Invalid argument

kernel has
options         IPFIREWALL
options         IPFIREWALL_VERBOSE      #enable logging to syslogd(8)
options         IPFIREWALL_VERBOSE_LIMIT=100    #limit verbosity
options         IPDIVERT
options         LIBALIAS

# kldstat
Id Refs Address    Size     Name
 1    3 0xc0400000 38b278   kernel
 2    1 0xc27d8000 8000     if_bridge.ko
 3    1 0xc27e0000 5000     bridgestp.ko

whack me with a clue bat, please

randy