Used ping, traceroute and a custom UDP program to send broadcast packets, and used dtrace to ensure that in_ifaddr_broadcast() was returning the right result.
Used traceroute -r to send packets on an SO_DONTROUTE socket and confirmed that in_ifaddr_broadcast() returned the right result and that a broadcast or unicast MAC address was used appropriately.