ipfw_alloc_rule
rule = ipfw_alloc_rule(chain, sizeof(struct ip_fw));
krule = ci->krule = ipfw_alloc_rule(chain, /* RULEKSIZE1(cmdlen) */
rule = ipfw_alloc_rule(chain, sizeof(*rule) + sizeof(ipfw_insn) + l);
struct ip_fw *ipfw_alloc_rule(struct ip_fw_chain *chain, size_t rulesize);
krule = ci->krule = ipfw_alloc_rule(chain, RULEKSIZE1(urule));