Prevent integer overflow in PF when calculating the adaptive timeout.
Mainly states of established TCP connections would be affected
resulting in immediate state removal once the numer of states is
bigger than adaptive.start.
Disabling adative timeouts with
set timeout { adaptive.start 0, adaptive.end 0 }
is a workaround to avoid this bug.
Issue found and initial diff by Mathieu Blanc (mathieu.blanc at cea dot fr)
The problem has been fixed in -current. For 5.9 and 6.0 the following
errata patches are available.
https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/019_pf.patch.sig
https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/036_pf.patch.sig
