ipfw(8) has means to filter and/or process (layer3) IP packets and (layer2) link-level frames. Kernel-side part of ipfw has distinct processors for layer2 and layer3 mbufs in the sys/netpfil/ipfw/ip_fw_pfil.c: ipfw_check_frame() and ipfw_check_packet() respectively.
Full set of ipfw actions is implemented within ipfw_check_packet() only and ipfw_check_frame() supports only allow/deny/ngtee/netgraph and dummynet-related actions. This means, for example, that "divert 1 ip from any to any layer2" does not work. This is not documented. This change adds some words on the topic.