Index: sbin/ipfw/dummynet.c
===================================================================
--- sbin/ipfw/dummynet.c
+++ sbin/ipfw/dummynet.c
@@ -23,6 +23,7 @@
  */
 
 #define NEW_AQM
+#include <sys/limits.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 /* XXX there are several sysctl leftover here */
@@ -794,9 +795,9 @@
  * set clocking interface or bandwidth value
  */
 static void
-read_bandwidth(char *arg, int *bandwidth, char *if_name, int namelen)
+read_bandwidth(char *arg, uint32_t *bandwidth, char *if_name, int namelen)
 {
-	if (*bandwidth != -1)
+	if (*bandwidth != (uint32_t)-1)
 		warnx("duplicate token, override bandwidth value!");
 
 	if (arg[0] >= 'a' && arg[0] <= 'z') {
@@ -810,7 +811,7 @@
 		strlcpy(if_name, arg, namelen);
 		*bandwidth = 0;
 	} else {	/* read bandwidth value */
-		int bw;
+		uint64_t bw;
 		char *end = NULL;
 
 		bw = strtoul(arg, &end, 0);
@@ -829,10 +830,10 @@
 		    _substrcmp2(end, "by", "bytes") == 0)
 			bw *= 8;
 
-		if (bw < 0)
+		if (bw > UINT_MAX)
 			errx(EX_DATAERR, "bandwidth too large");
 
-		*bandwidth = bw;
+		*bandwidth = (uint32_t)bw;
 		if (if_name)
 			if_name[0] = '\0';
 	}
@@ -1737,7 +1738,7 @@
 	if (p) {
 		if (p->delay > 10000)
 			errx(EX_DATAERR, "delay must be < 10000");
-		if (p->bandwidth == -1)
+		if (p->bandwidth == (uint32_t)-1)
 			p->bandwidth = 0;
 	}
 	if (fs) {
Index: sys/netinet/ip_dummynet.h
===================================================================
--- sys/netinet/ip_dummynet.h
+++ sys/netinet/ip_dummynet.h
@@ -131,7 +131,7 @@
 	 * XXX what about burst ?
 	 */
 	int32_t		link_nr;
-	int		bandwidth;	/* bit/s or bits/tick.   */
+	uint32_t	bandwidth;	/* bit/s or bits/tick.   */
 	int		delay;		/* ms and ticks */
 	uint64_t	burst;		/* scaled. bits*Hz  XXX */
 };
@@ -214,7 +214,7 @@
 	char	name[ED_MAX_NAME_LEN];
 	int	link_nr;
 	int	loss_level;
-	int	bandwidth;			// XXX use link bandwidth?
+	uint32_t	bandwidth;			// XXX use link bandwidth?
 	int	samples_no;			/* actual len of samples[] */
 	int	samples[ED_MAX_SAMPLES_NO];	/* may be shorter */
 };
Index: sys/netpfil/ipfw/ip_dn_glue.c
===================================================================
--- sys/netpfil/ipfw/ip_dn_glue.c
+++ sys/netpfil/ipfw/ip_dn_glue.c
@@ -166,7 +166,7 @@
 	SLIST_ENTRY(dn_pipe7)    next;   /* linked list in a hash slot */
 
 	int pipe_nr ;       /* number   */
-	int bandwidth;      /* really, bytes/tick.  */
+	uint32_t bandwidth;      /* really, bytes/tick.  */
 	int delay ;         /* really, ticks    */
 
 	struct  mbuf *head, *tail ; /* packets in delay line */
@@ -231,7 +231,7 @@
 	SLIST_ENTRY(dn_pipe8)    next;   /* linked list in a hash slot */
 
 	int pipe_nr ;       /* number   */
-	int bandwidth;      /* really, bytes/tick.  */
+	uint32_t bandwidth;      /* really, bytes/tick.  */
 	int delay ;         /* really, ticks    */
 
 	struct  mbuf *head, *tail ; /* packets in delay line */
Index: sys/netpfil/ipfw/ip_dn_io.c
===================================================================
--- sys/netpfil/ipfw/ip_dn_io.c
+++ sys/netpfil/ipfw/ip_dn_io.c
@@ -591,7 +591,8 @@
 	struct dn_schk *s = si->sched;
 	struct mbuf *m = NULL;
 	int delay_line_idle = (si->dline.mq.head == NULL);
-	int done, bw;
+	int done;
+	uint32_t bw;
 
 	if (q == NULL) {
 		q = &def_q;