So I upgraded my nat box / firewall to -current because I
wanted to play with IPSEC and test the new ipf code when it
comes out.

  With the result that I now have a machine that goes comatose
once a day, usually running out of mbufs (sendto: no buffer space
available) or being generally unresponsive (telnet connects, then
nothing happens; not even login on console possible).

  I suspect it's a weird interaction between ipf and ipsec,
or perhaps ipsec without ipv6, something like that. 

  My question is now, what to do to trace that down? Just filing
a PR with "my machine wedges after a day" is a bit on the thin
side. I'm just compiling a kernel with DIAGNOSTICS and DDB, so
what should I do when the machine runs out of buf space? What
should I do when it wedges?

	mjl