pfSense

The pflog device is apparently not outputting proper data on amd64, but it is working on i386.

Sample contents of the filter.log on amd64:

May  8 09:37:13 pfs22 filterlog: 79,16777216,,1000002665,lo0,match,pass,out,15,bad-len=0,15
May  8 09:37:13 pfs22 filterlog: 75,16777216,,1000002661,lo0,match,pass,in,15,bad-len=0,15
May  8 09:37:13 pfs22 filterlog: 79,16777216,,1000002665,em0,match,pass,out,13,bad-hlen=8),13
May  8 09:37:13 pfs22 filterlog: 81,16777216,,1000002761,em0,match,pass,out,1,error='truncated-ip 16328 bytes missing!',0xbb,CE,192,16390,41664,+,168,unknown,16384,208.123.73.83,201.31.1.187,1
May  8 09:37:19 pfs22 filterlog: 81,16777216,,1000002761,em0,match,pass,out,7,bad-len=0,7

It is not confined to filterlog, and tcpdump on the pflog interface yields similar corruption:

00:00:02.785281 rule 79..16777216/0(match): pass out on lo0: IP14 bad-len 0
00:00:00.000025 rule 75..16777216/0(match): pass in on lo0: IP14 bad-len 0
00:00:00.000412 rule 79..16777216/0(match): pass out on lo0: IP1 bad-hlen 12
00:00:00.000094 rule 75..16777216/0(match): pass in on lo0: IP1 bad-hlen 12
00:00:00.000128 rule 79..16777216/0(match): pass out on em0: IP12 bad-len 0
00:00:00.013982 rule 81..16777216/0(match): pass out on em0: bad-hlen 4

Working example from i386:

May  8 09:38:08 pfs22-1 filterlog: 79,16777216,,1000106055,lo0,match,pass,out,4,0x0,,64,15246,0,none,17,udp,67,127.0.0.1,127.0.0.1,63334,53,47
May  8 09:38:08 pfs22-1 filterlog: 75,16777216,,1000106051,lo0,match,pass,in,4,0x0,,64,15246,0,none,17,udp,67,127.0.0.1,127.0.0.1,63334,53,47
May  8 09:38:08 pfs22-1 filterlog: 79,16777216,,1000106055,lo0,match,pass,out,4,0x0,,64,18370,0,none,17,udp,67,127.0.0.1,127.0.0.1,22899,53,47
May  8 09:38:08 pfs22-1 filterlog: 75,16777216,,1000106051,lo0,match,pass,in,4,0x0,,64,18370,0,none,17,udp,67,127.0.0.1,127.0.0.1,22899,53,47
May  8 09:38:08 pfs22-1 filterlog: 79,16777216,,1000106055,em0,match,pass,out,4,0x0,,64,26001,0,none,17,udp,67,192.168.20.86,192.168.20.1,62033,53,47