Quick and dirty

All configuration of ipfw is done by issuing the command ipfw. In your case this is wrapped into ${fwcmd} and is a parameter substitution (see sh(0) paragraph Parameter Expansion). /etc/rc.firewall can then be treated as a sh shell script (with some additional helper functions).

It is then as simple as:

cat list.txt | xargs -I BANIP ${fwcmd} add deny ip from BANIP to any

The file list.txt is piped into xargs which contructs the command. list.txt should contain one IP address or subnet per line.

Example:

122.228.19.80
185.234.219.65
92.118.38.57/24
185.36.81.143/24

Be quiet

From your question we cannot see what ${fwcmd} expands to. It might be as simple as ipfw. For use in a script it is a good idea to use ipfw -q (see ipfw(8)) to make it more robust. It will create a table for you when adding and gracefully handle adding the same address twice.

Tables

Adding a whole bunch of deny rules as above is a little messy. It will be much cleaner if you put them into a table and then base the rule on the table.

First we create the table #1 and populate it:

ipfw -q table 1 add 122.228.19.80
ipfw -q table 1 add 185.234.219.65
ipfw -q table 1 add 92.118.38.57/24
ipfw -q table 1 add 185.36.81.143/24

Then we use the table in our rule:

ipfw add deny ip from 'table(1)' to any

We then use the same list.txt as before. We can then flush and reload the table on the go:

ipfw table 1 flush
cat list.txt | xargs ipfw -q table 1 add

The above can be executed on the command line while playing around.

And in context of your configuration script it would be something like:

cat list.txt | xargs ${fwcmd} table 1 add
${fwcmd} add deny ip from 'table(1)' to any

The 'ticks' around table(1) is to ensure the shell does not try to interpret () in any way. You could choose to escape them as well. Same result but is a little harder for a human to read.

${fwcmd} add deny ip from table\(1\) to any