There's a fallthough bug in a switch statement for lookup opcode caused by an extra else statement: legitimate IPv4 and IPv6 packets fall through to LOOKUP_DSCP case while they must exit switch.

Create rules

ipfw table mytable create type addr
ipfw table mytable add 192.168.0.0/16 # put your source address here
ipfw add count ip from any to any lookup src-ip mytable

Observe packets matching the rule