M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/include/net/if.h

@@ -0,0 +1,54 @@
+/* PFLINUX: <net/if.h> — glibc's <net/if.h> plus OpenBSD's interface-group
+ * ABI (sys/sockio.h) used by pfctl_parser.c (ifa_exists/ifa_grouplookup).
+ * Linux has no interface groups: SIOCGIFGMEMB keeps the OpenBSD encoding
+ * (it is computed with our OpenBSD _IOWR) and every use of it on an AF_INET
+ * socket returns ENOTTY, so group lookups degrade to "not a group" exactly
+ * like on an OpenBSD without the group. */
+#ifndef _PFLINUX_NET_IF_H
+#define _PFLINUX_NET_IF_H
+
+#include_next <net/if.h>
+
+#include <sys/ioctl.h>
+#include <sys/types.h>
+
+#ifndef IFNAMSIZ
+#define IFNAMSIZ IF_NAMESIZE
+#endif
+
+#define IFG_ALL		"all"	/* group contains all interfaces */
+#define IFG_EGRESS	"egress"	/* if(s) default route(s) point to */
+
+struct ifg_req {
+	union {
+		char	ifgrqu_group[IFNAMSIZ];
+		char	ifgrqu_member[IFNAMSIZ];
+	} ifgrq_ifgrqu;
+#define ifgrq_group	ifgrq_ifgrqu.ifgrqu_group
+#define ifgrq_member	ifgrq_ifgrqu.ifgrqu_member
+};
+
+struct ifgroupreq {
+	char	ifgr_name[IFNAMSIZ];
+	u_int	ifgr_len;
+	union {
+		char		 ifgru_group[IFNAMSIZ];
+		struct ifg_req	*ifgru_groups;
+	} ifgr_ifgru;
+#define ifgr_group	ifgr_ifgru.ifgru_group
+#define ifgr_groups	ifgr_ifgru.ifgru_groups
+};
+
+#ifndef SIOCGIFGMEMB
+#define SIOCGIFGMEMB	_IOWR('i', 138, struct ifgroupreq) /* OpenBSD value */
+#endif
+
+/* PFLINUX: OpenBSD if.h queue-priority range (parse.y `prio` check) */
+#ifndef IFQ_NQUEUES
+#define IFQ_NQUEUES	8
+#endif
+#ifndef IFQ_MAXPRIO
+#define IFQ_MAXPRIO	(IFQ_NQUEUES - 1)
+#endif
+
+#endif /* _PFLINUX_NET_IF_H */

tools/include/net/if_dl.h

@@ -0,0 +1,30 @@
+/* PFLINUX: <net/if_dl.h> — BSD link-layer address.  Linux has no AF_LINK;
+ * getifaddrs() reports link-layer addresses as AF_PACKET/struct sockaddr_ll.
+ * We therefore define AF_LINK as AF_PACKET and lay struct sockaddr_dl out
+ * exactly like struct sockaddr_ll, so pfctl_parser.c's
+ * ((struct sockaddr_dl *)ifa->ifa_addr)->sdl_index finds sll_ifindex.
+ * Everything stays userland-internal: af values tagged AF_LINK never cross
+ * /dev/pf (rules carry ifname strings, not sockaddr families). */
+#ifndef _PFLINUX_NET_IF_DL_H
+#define _PFLINUX_NET_IF_DL_H
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#ifndef AF_LINK
+#define AF_LINK		AF_PACKET	/* PFLINUX mapping, see header note */
+#endif
+
+struct sockaddr_dl {
+	sa_family_t	sdl_family;	/* sll_family   (offset 0)  */
+	u_short		sdl_protocol;	/* sll_protocol (offset 2)  */
+	int		sdl_index;	/* sll_ifindex  (offset 4)  */
+	u_short		sdl_type;	/* sll_hatype   (offset 8)  */
+	u_char		sdl_pkttype;	/* sll_pkttype  (offset 10) */
+	u_char		sdl_alen;	/* sll_halen    (offset 11) */
+	u_char		sdl_data[8];	/* sll_addr     (offset 12) */
+};
+
+#define LLADDR(s)	((caddr_t *)((s)->sdl_data))
+
+#endif /* _PFLINUX_NET_IF_DL_H */

tools/include/net/route.h

@@ -0,0 +1,32 @@
+/* PFLINUX: <net/route.h> — the userland-visible subset of OpenBSD's
+ * <net/route.h>/<sys/socket.h> routing constants that net/pfvar.h
+ * (RTLABEL_LEN) and parse.y (CTL_NET route lookups) rely on.  Linux'
+ * glibc <net/route.h> carries only struct rtentry/ioctls, so this shim
+ * shadows it.  Values copied from OpenBSD 8.0 sys/sys/socket.h and
+ * sys/net/route.h; RT_TABLEID_MAX matches module/include/pfk.h (32),
+ * the routing-domain ceiling our pf.ko implements. */
+#ifndef _PFLINUX_NET_ROUTE_H
+#define _PFLINUX_NET_ROUTE_H
+
+#include <sys/types.h>
+
+/* PFLINUX: AF_ROUTE/PF_ROUTE (== 17) come from glibc <sys/socket.h>
+ * unmodified; only the routing-table constants pfvar.h/parse.y need
+ * live here. */
+
+#define NET_RT_DUMP	1
+#define NET_RT_FLAGS	2
+#define NET_RT_IFLIST	3
+#define NET_RT_TABLE	5
+
+#define RTLABEL_LEN	32
+#define RT_TABLEID_MAX	32	/* keep in sync with module/include/pfk.h */
+
+struct rt_tableinfo {
+	u_short	rti_tableid;	/* routing table id */
+	u_short	rti_domainid;	/* routing domain id */
+};
+
+struct rtentry;			/* only referenced via pointers/prototypes */
+
+#endif /* _PFLINUX_NET_ROUTE_H */