Problem description:
When insufficient memory is available to handle an
incoming selective acknowledgement, the TCP/IP stack may
enter an infinite loop.
Impact:
By opening a TCP connection and sending a carefully crafted
series of packets, an attacker may be able to cause a denial
of service.
Workaround:
On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to
disable the use of SACK:

sysctl net.inet.tcp.sack.enable=0

No workaround is available for FreeBSD 5.3.