doc: fragments cross, callers are checked, and the open list is shorter

man/fw said a fragmented datagram does not cross.  IPv4 ones now do:
the first piece decides and the train inherits.  IPv6 fragments still
do not, because the extension header they live in is not walked, and
that is what the paragraph says now.

The altitude paragraph said request filtering cannot stop an inbound
connection before the handshake.  Still true, and still worth saying,
but it now refuses the connection to the program and hangs it up, which
is the difference between a rule that is late and one that does
nothing.  fwrules(6) gains the other half of that: an in rule naming an
ip cannot decide an announce, and decides the connection instead.

todo.md loses the six items that are now fixed and gains a third round.
One of them is a correction rather than a fix: the interface tables
being read into fixed buffers was reported as losing the default route,
and it was not -- routes come out sorted and 0.0.0.0 sorts first, so it
was always on the first line.  Worth removing the limits anyway; not
worth having claimed it broke something.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions