With the pending retirement of GIANT, this patch will make ipfilter's sysctl's mpsafe.
Currently running on my infrastructure.
The handler was under "assumed" GIANT. IPF itself uses two other locking mechanisms, common to NetBSD and Solaris (Illumos). I intend to replace them with one of the more modern locks. Given they're called by macros the job won't be as daunting as expected.