Some things to remember.

Resolution of dummynet is 1/HZ. For precise emulation, compile your kernel with

options HZ=1000

When doing simulations over loopback, watch out the MTU and TCP slowstart

sysctl net.inet.tcp.local_slowstart_flightsize=1

Normally, packets are accepted once they come out of a pipe 
sysctl net.inet.ip.fw.one_pass=1

Setting the variable to 0 caused packets to be reinjected into the firewall
You can build arbitrary configurations with a bit of fantasy and plumbing.