FreeBSD -- ICMP/ICMP6 packet filter bypass in pf

Problem Description:
States in pf(4) let ICMP and ICMP6 packets pass if they
have a packet in their payload matching an existing condition.
pf(4) does not check if the outer ICMP or ICMP6 packet has
the same destination IP as the source IP of the inner
protocol packet.
Impact:
A maliciously crafted ICMP/ICMP6 packet could bypass the
packet filter rules and be passed to a host that would
otherwise be unavailable.