kern/168190: [pf] panic when using pf and route-to (maybe: bad fragment handling?)

[Daniel Hartmeier]

BTW, if the theory is correct, you should be able to reproduce the
problem by sending a packet in from $vpn_net to a host in $srv_net
of size 334 (=306+28), e.g. with

  $ ping -s 306 172.16.1.1

Daniel