keep-state rules inadequately handles big UDP packets or fragmented IP packets?

[Dmitriy Demidov]

On Sunday 15 March 2009, Sergey Matveychuk wrote:
> Dmitriy Demidov wrote:
> > Hi Luigi. Thank you for answer.
> > It is a big "surprise" for me that reassembling of IP datagrams is done not *before* they go into firewall, but *after* :(
> 
> But what's wrong with it? A fragment got from net, pass firewall and 
> store. After all fragments we got, OS reassembly a packet and pass it 
> through firewall again.
> 

>>it is not related to dynamic rules, but to the fact that
>>that the firewall is called before reassembling packets.
>>The info (port numbers especially) is not available
>>in the fragments so the firewall cannot do anything.
>>The only solution would be to call the firewall
>>after reassembly. I am not sure if there is any work in progress
>>for that.

If I got it right from Luigi explanation, then problem we see here happens this way:
ipfw receivs fragmented IP datagrams what contains splited UDP packet insight
(IP-fragment1/UDP-head) + (IP-fragment2/UDP-tail), and it can not procead second one
because of lack of UDP header? IP reassembling happens after ipfw?