When the process tries to write to the socket after the connection has been closed, it gets a SIGPIPE signal. Without custom signal handling, the default action is to terminate the process, see signal(3). signal(3).
Basic socket programming issue, the author sucks. Try the patch below ;) Daniel Index: pfstatd.c =================================================================== RCS file: /var/cvs/pfstat/pfstatd/pfstatd.c,v retrieving revision 1.1.1.1 diff -u -r1.1.1.1 pfstatd.c --- pfstatd.c 11 Jan 2007 16:01:58 -0000 1.1.1.1 +++ pfstatd.c 26 Mar 2008 17:58:05 -0000 @@ -39,6 +39,7 @@ #include <errno.h> #include <fcntl.h> #include <pwd.h> +#include <signal.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -97,6 +98,7 @@ } if (argc != optind) usage(); + signal(SIGPIPE, SIG_IGN); if ((fdp = open("/dev/pf", O_RDONLY)) < 0) { fprintf(stderr, "open: /dev/pf: %s\n", strerror(errno)); return (1);