Big news: Sepherosa Ziehau has managed to remove the Big Giant Lock from the ip and bridge forwarding path.  This includes ipfw, though not yet pf.   It is in fact possible to make the whole TCP/UDP code path BGL-free.  Sepeherosa helpfully posted some benchmarks to show just how significant the improvements can be.