Remove old ballast, clean up a little bit, staticize.
Add five sysctl variables that you should probably never tweak.
net.arp.t_prune: 300
net.arp.t_keep: 1200
net.arp.t_down: 20
net.arp.maxtries: 5
net.arp.useloopback: 1
net.arp.proxyall: 0

(It's net.arp because arp isn't limited to inet, though our present
implementation surely is).