MFC r286862:

Fix the copy of addresses passed from userland in table replace command.

  The size2 is the maximum userland buffer size (used when the addresses are
  copied back to userland).

  Obtained from:	pfSense
  Sponsored by:	Rubicon Communications (Netgate)

sys/netpfil/pf/pf_ioctl.c

@@ -2718,8 +2718,7 @@ DIOCCHANGEADDR_error:
 			error = ENODEV;
 			break;
 		}
-		totlen = (io->pfrio_size + io->pfrio_size2) *
-		    sizeof(struct pfr_addr);
+		totlen = io->pfrio_size * sizeof(struct pfr_addr);
 		pfras = malloc(totlen, M_TEMP, M_WAITOK);
 		error = copyin(io->pfrio_buffer, pfras, totlen);
 		if (error) {