CBQ download limits failed...

Hi all,

I'm trying to implement queue using PF in OpenBSD box. The pf.conf looks 
like:

# ISP1
ext_if1="fxp0"
ext_gw1="217.126.43.2"

# ISP2
ext_if2="bge1"
ext_gw2="192.168.10.1"

# IPs workmates
lesmes="192.168.0.121"
alejandro="192.168.0.51"
xevi="192.168.0.124"
santi="192.168.0.49"
dominis = "{" $lesmes $alejandro $xevi $santi "}"
laura="192.168.0.79"
gemma="192.168.0.78"
facturacio = "{" $laura $gemma "}"
marc="192.168.0.39"
pau="192.168.0.43"
joni="192.168.0.48"
web = "{" $marc $pau $joni "}"
josep="192.168.0.201"
jordi="192.168.0.174"
prog_sistemes= "{" $josep $jordi "}"

# internal gatewaY
lan_net="192.168.0.0/24"
int_if="bge0"
int_gw="192.168.0.1"

# altres macros
my_networks="{ xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx}"
callcenter02="xxx.xxx.xxx.xxx"

# 2.Tables
# Not used at present
# 3.Options
set skip on lo
set optimization conservative

# 4. Scrub traffic
scrub all

# 5. Queueing
# ISP1 queues, 10MBps
altq on $ext_if1 priq bandwidth 10Mb queue { my1, centraleta, ssh1, nomy1 }
      queue centraleta priority 7
      queue my1 priority 6
      queue ssh1 priority 5
      queue nomy1 priority 1 priq (default)

#  ISP2 queues (10Mbps)
altq on $ext_if2 cbq bandwidth 10Mb queue { nomy2, my2, ssh2 }
         queue my2 bandwidth 50% priority 7 cbq(default)
         queue nomy2 bandwidth 5% priority 0 cbq
         queue ssh2 bandwidth 45% priority 6 cbq(borrow)

# 6. Translation
nat on $ext_if1 from $lan_net to any -> ($ext_if1)
nat on $ext_if2 from $lan_net to any -> ($ext_if2)

# 7. Filer rules
pass in quick on $ext_if1 proto icmp from any to any

#  pass all outgoing packets on internal interface
pass out on $int_if from any to $lan_net

#  pass in quick any packets destined for the gateway itself
pass in quick on $int_if from $lan_net to $int_if

# dominis, facturacio sshd
pass in quick on $int_if route-to \
     ($ext_if1 $ext_gw1) \
     proto tcp from { $dominis $facturacio } to any port 22 flags S/SA 
keep state \
     queue ssh1

# dominis i facturacio callcenter02
pass in on $int_if route-to \
     ($ext_if1 $ext_gw1) \
     proto udp from { $dominis $facturacio } to $callcenter02 keep state \
     queue centraleta

# dominis i facturacio my1
pass in quick on $int_if route-to \
     ($ext_if1 $ext_gw1) \
     proto { udp, tcp } from { $dominis $facturacio } to $my_networks 
keep state \
     queue my1

# dominis i facturacio !my_networks
pass in quick on $int_if route-to \
     ($ext_if1 $ext_gw1) \
     proto { udp, tcp } from { $dominis $facturacio } to any keep state \
     queue nomy1

# web i prog_sistemes sshd
pass in quick on $int_if route-to \
     ($ext_if2 $ext_gw2) \
     proto tcp from { $web $prog_sistemes } to any port 22 flags S/SA 
keep state \
     queue ssh2

# web i prog_sistemes $my_networks
pass in quick on $int_if route-to \
     ($ext_if2 $ext_gw2) \
     proto { udp, tcp } from { $web $prog_sistemes } to $my_networks 
keep state \
     queue my2

# web i prog_sistemes !my_networks
pass in quick on $int_if route-to \
     ($ext_if2 $ext_gw2) \
     proto { udp, tcp } from { $web $prog_sistemes } to any keep state \
     queue nomy2

#  general "pass out" rules for external interfaces
pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if1 proto { udp, icmp } from any to any keep state
pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if2 proto { udp, icmp } from any to any keep state

As you can see above, I try to redirect my workmates to one queue 
depending on the target traffic. Note also that I use 2 differents ISPs 
connections.

The main problem is when someone (let's to suppose my workmate Josep) 
wants to download a big file which is _not inside my networks_, the 
target rule is:

# web i prog_sistemes !my_networks
pass in quick on $int_if route-to \
     ($ext_if2 $ext_gw2) \
     proto { udp, tcp } from { $web $prog_sistemes } to any keep state \
     queue nomy2

Using 'systat queue' I can see that Josep uses the nomy2 queue, but... 
¡he downloads using all the bandwidth available (10Mbps)!
But, indeed, the nomy2 queue is defined as:

queue nomy2 bandwidth 5% priority 0 cbq

So, it's supposed that only 5% is allowed; moreover, the 'borrow' 
parameter isn't used also.

¿How I can debug it?
¿Any ideas?

TIA.

-- 
I must not fear. Fear is the mind-killer. Fear is the little-death that 
brings total obliteration. I will face my fear. I will permit it to pass 
over me and through me. And when it has gone past I will turn the inner 
eye to see its path. Where the fear has gone there will be nothing. Only 
I will remain.

Bene Gesserit Litany Against Fear.

-- 
I must not fear. Fear is the mind-killer. Fear is the little-death that 
brings total obliteration. I will face my fear. I will permit it to pass 
over me and through me. And when it has gone past I will turn the inner 
eye to see its path. Where the fear has gone there will be nothing. Only 
I will remain.

Bene Gesserit Litany Against Fear.