commit 2519e3d90949531711c5345da5f5e4577a749a29
Author: Mark Johnston <markj@FreeBSD.org>
Date:   Mon Jun 14 16:52:21 2021 -0400

    ipfw: Update the pfil mbuf pointer in ipfw_check_frame()
    
    ipfw_chk() might call m_pullup() and thus can change the mbuf chain
    head.  In this case, the new chain head has to be returned to the pfil
    hook caller.
    
    PR:     256439
    Fixes:  f355cb3e6

diff --git a/sys/netpfil/ipfw/ip_fw_pfil.c b/sys/netpfil/ipfw/ip_fw_pfil.c
index e21831c80ec6..01a44df47180 100644
--- a/sys/netpfil/ipfw/ip_fw_pfil.c
+++ b/sys/netpfil/ipfw/ip_fw_pfil.c
@@ -371,6 +371,8 @@ ipfw_check_frame(pfil_packet_t p, struct ifnet *ifp, int flags,
 	}
 
 	ipfw = ipfw_chk(&args);
+	if (!mem)
+		*p.m = args.m;
 
 	ret = PFIL_PASS;
 	switch (ipfw) {