Not dealing with this is a really, really poor design decision.
The proper way to do it would be to keep the kernel ABI constant
so that you could upgrade one side but not the other.  Or, at a minimum,
it should detect that there's a version mismatch.  How ipf can be allowed
to be part of NetBSD in its current state is a mystery to me.

    -- Lennart

Martin Husemann wrote:

> > # ipnat -l
> > List of active MAP/Redirect filters:
> > unknown value for in_redir: 0
> >   0.0.0.0/0  -> 0.0.0.0/0
>
> Your kernel and ipf-userland are out of sync. Unfortunately ipf does not deal
> with that.
>
> Martin