In some email I received from Manuel Bouyer, sie wrote:
> I guess this change in the NetBSD tree would look like what's appended
> below (could you check it's correct please ?).

No.  You lose nat->nat_aps being updated from ap_new_session().  It should
look something like this:
...
        if (nat->nat_aps == NULL)
                nat->nat_aps = ap_new_session(nat->nat_ptr->in_apr, ip,
                                              fin, nat);
        aps = nat->nat_aps;
        if ((aps != NULL) && (aps->aps_p == ip->ip_p)) {
...

> This will make ap_check() return -1 instead of 2, will this cause problems in
> the future ? (for now the return value of ap_check() seems to not be used)

Not likely.

> As this change does basically the same thing I don't expect problems with
> it. I'll test when I get close to this router again.

Except that it doesn't `protect' the other proxies which are TCP based but
go through the same kind of machinations as the FTP one.

Darren