panic: kmem_map too small at heavy packet traffic

[Mark Felder]

I've been under the impression that synproxy was broken for quite some
time, but I know there has been a lot of work on pf in HEAD so I can't
be sure where it might stand there. Can anyone confirm/deny this?

And not to discourage you, but the pf documentation does say "Routine
use of this option is not recommended, however, as it breaks expected
TCP protocol behavior when the server can't process the request..."

However, panics are never good and hopefully someone can help you figure
it out.