diff --git a/sys/netpfil/ipfw/dn_aqm.h b/sys/netpfil/ipfw/dn_aqm.h
--- a/sys/netpfil/ipfw/dn_aqm.h
+++ b/sys/netpfil/ipfw/dn_aqm.h
@@ -53,9 +53,6 @@
 /* Macro for variable bounding */
 #define BOUND_VAR(x,l,h)  ((x) > (h)? (h) : ((x) > (l)? (x) : (l)))
 
-/* sysctl variable to count number of dropped packets */
-extern unsigned long io_pkt_drop; 
-
 /*
  * Structure for holding data and function pointers that together represent a
  * AQM algorithm.
@@ -137,7 +134,7 @@
 	if (drop) {
 			qni->drops++;
 			sni->drops++;
-			io_pkt_drop++;
+			dn_cfg.io_pkt_drop++;
 	} else {
 		/*update queue stats */
 		qni->length += inc;
diff --git a/sys/netpfil/ipfw/dn_sched_fq_codel.h b/sys/netpfil/ipfw/dn_sched_fq_codel.h
--- a/sys/netpfil/ipfw/dn_sched_fq_codel.h
+++ b/sys/netpfil/ipfw/dn_sched_fq_codel.h
@@ -104,7 +104,7 @@
 		si->main_q.ni.drops ++;
 		q->stats.drops ++;
 		si->_si.ni.drops ++;
-		io_pkt_drop ++;
+		dn_cfg.io_pkt_drop ++;
 	} 
 
 	if (!drop || (drop && len < 0)) {
diff --git a/sys/netpfil/ipfw/dn_sched_fq_pie.c b/sys/netpfil/ipfw/dn_sched_fq_pie.c
--- a/sys/netpfil/ipfw/dn_sched_fq_pie.c
+++ b/sys/netpfil/ipfw/dn_sched_fq_pie.c
@@ -299,7 +299,7 @@
 		si->main_q.ni.drops ++;
 		q->stats.drops ++;
 		si->_si.ni.drops ++;
-		io_pkt_drop ++;
+		dn_cfg.io_pkt_drop ++;
 	} 
 
 	if (!drop || (drop && len < 0)) {
diff --git a/sys/netpfil/ipfw/ip_dn_io.c b/sys/netpfil/ipfw/ip_dn_io.c
--- a/sys/netpfil/ipfw/ip_dn_io.c
+++ b/sys/netpfil/ipfw/ip_dn_io.c
@@ -88,14 +88,6 @@
 /* Adjusted vs non-adjusted curr_time difference (ticks). */
 static long tick_diff;
 
-static unsigned long	io_pkt;
-static unsigned long	io_pkt_fast;
-
-#ifdef NEW_AQM
-unsigned long	io_pkt_drop;
-#else
-static unsigned long	io_pkt_drop;
-#endif
 /*
  * We use a heap to store entities for which we have pending timer events.
  * The heap is checked at every tick and all entities with expired events
@@ -228,13 +220,13 @@
 SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, queue_count,
     CTLFLAG_RD, DC(queue_count), 0, "Number of queues");
 SYSCTL_ULONG(_net_inet_ip_dummynet, OID_AUTO, io_pkt,
-    CTLFLAG_RD, &io_pkt, 0,
+    CTLFLAG_RD, DC(io_pkt), 0,
     "Number of packets passed to dummynet.");
 SYSCTL_ULONG(_net_inet_ip_dummynet, OID_AUTO, io_pkt_fast,
-    CTLFLAG_RD, &io_pkt_fast, 0,
+    CTLFLAG_RD, DC(io_pkt_fast), 0,
     "Number of packets bypassed dummynet scheduler.");
 SYSCTL_ULONG(_net_inet_ip_dummynet, OID_AUTO, io_pkt_drop,
-    CTLFLAG_RD, &io_pkt_drop, 0,
+    CTLFLAG_RD, DC(io_pkt_drop), 0,
     "Number of packets dropped by dummynet.");
 #undef DC
 SYSEND
@@ -540,7 +532,7 @@
 	return (0);
 
 drop:
-	io_pkt_drop++;
+	dn_cfg.io_pkt_drop++;
 	q->ni.drops++;
 	ni->drops++;
 	FREE_PKT(m);
@@ -882,7 +874,7 @@
 	else if (fwa->flags & IPFW_ARGS_IP6)
 		dir |= PROTO_IPV6;
 	DN_BH_WLOCK();
-	io_pkt++;
+	dn_cfg.io_pkt++;
 	/* we could actually tag outside the lock, but who cares... */
 	if (tag_mbuf(m, dir, fwa))
 		goto dropit;
@@ -918,7 +910,7 @@
 		m = *m0 = NULL;
 
 		/* dn_enqueue already increases io_pkt_drop */
-		io_pkt_drop--;
+		dn_cfg.io_pkt_drop--;
 
 		goto dropit;
 	}
@@ -956,7 +948,7 @@
 
 		tag->m_tag_cookie = MTAG_IPFW_RULE;
 		tag->m_tag_id = 0;
-		io_pkt_fast++;
+		dn_cfg.io_pkt_fast++;
 		if (m->m_nextpkt != NULL) {
 			printf("dummynet: fast io: pkt chain detected!\n");
 			m->m_nextpkt = NULL;
@@ -972,7 +964,7 @@
 	return 0;
 
 dropit:
-	io_pkt_drop++;
+	dn_cfg.io_pkt_drop++;
 	DN_BH_WUNLOCK();
 	if (m)
 		FREE_PKT(m);
diff --git a/sys/netpfil/ipfw/ip_dn_private.h b/sys/netpfil/ipfw/ip_dn_private.h
--- a/sys/netpfil/ipfw/ip_dn_private.h
+++ b/sys/netpfil/ipfw/ip_dn_private.h
@@ -131,6 +131,11 @@
 	int	fsk_count;
 	int	queue_count;
 
+	/* packet counters */
+	unsigned long	io_pkt;
+	unsigned long	io_pkt_fast;
+	unsigned long	io_pkt_drop;
+
 	/* ticks and other stuff */
 	uint64_t	curr_time;
 	/* flowsets and schedulers are in hash tables, with 'hash_size'