IPFW does not have any options to modify packet's TTL directly. It can match a packet that has particular TTL range, but does not have any rules to modify it. Here's complete ipfw syntax.
As you can see, action list is fairly limited:
"ACTION: check-state | allow | count | deny | unreach{,6} CODE |\n"
" skipto N | {divert|tee} PORT | forward ADDR |\n"
" pipe N | queue N | nat N | setfib FIB | reass\n"
You could divert the packet to an application and let it modify and reinject it, but that would require a custom app to do it. Sort of what natd
does, only instead of IP addresses and ports it would change TTL.