overloading to a tiny queue

pass log quick on $ext_if proto tcp from any to any port ssh flags S/SA \
keep state queue (ssh_bulk, ssh_interactive)

becomes

pass log quick on $ext_if proto tcp from any to any port ssh flags S/SA \
keep state (max-src-conn 15, max-src-conn-rate 5/3, \
     overload <bruteforce> flush global) \
     queue (ssh_bulk, ssh_interactive)

where

queue smallpipe bandwidth 1% cbq

and

pass inet proto tcp from <bruteforce> to any \
     port $tcp_services queue smallpipe