The check for invalid IPv6 fragment size in pf_normalize_ip6() was wrong.  As an effect small valid fragmented packets got dropped and some invalid fragmented packets were passed.  plen is the payload lenght of the ipv6 packet without the ipv6 header.  off is relative to the whole packet including the ipv6 header.  Add sizeof(struct ip6_hdr) in the calculation. ok henning@ markus@
The check for invalid IPv6 fragment size in pf_normalize_ip6() was
wrong.  As an effect small valid fragmented packets got dropped and
some invalid fragmented packets were passed.  plen is the payload
lenght of the ipv6 packet without the ipv6 header.  off is relative
to the whole packet including the ipv6 header.  Add sizeof(struct
ip6_hdr) in the calculation.
ok henning@ markus@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars