As for now there is no compatibility layer for a changed KABI of ipfw kernel module after D46183 was merged. This leads to inability to upgrade a remote server running ipfw as `RELENG_15` kernel does not accept commands from an old `ipfw` binary.
Instead of making a kernel-side compatibility layer that is hard to debug and maintain, we can import `sbin/ipfw` from `RELENG_15` as a new binary `sbin/ipfw15` into `RELENG_14`. Once new binary is there,
original `sbin/ipfw` can detect new KABI and run the new binary instead.
A trivial and naive patch for `sbin/ipfw` is attached. Header-only modified copy of `sbin/ipfw` from `RELENG_15` is attached to the diff as well.