The pf_test_rule function in OpenBSD Packet Filter (PF) as used in OpenBSD 4.2 through 4.5 NetBSD 5.0 before RC3 MirOS 10 and earlier and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation related to an IPv4 packet with an ICMPv6 payload.