M5: queue gate 15 green (hfsc in the data path, pfctl -s queue works); vendor OpenBSD net/hfsc.h + net/fq_codel.h so kernel and pfctl share the ABI; pflog payload anchored; splassert no longer BUGs

module/compat/.md5.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/md5.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/md5.o: $(deps_compat/md5.o)
 

module/compat/.pfk_if.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_if.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_if.o: $(deps_compat/pfk_if.o)
 

module/compat/.pfk_ifq.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_ifq.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_ifq.o: $(deps_compat/pfk_ifq.o)
 

module/compat/.pfk_ip4.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_ip4.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_ip4.o: $(deps_compat/pfk_ip4.o)
 

module/compat/.pfk_ip6.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_ip6.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_ip6.o: $(deps_compat/pfk_ip6.o)
 

module/compat/.pfk_kern.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_kern.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_kern.o: $(deps_compat/pfk_kern.o)
 

module/compat/.pfk_mbuf.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_mbuf.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_mbuf.o: $(deps_compat/pfk_mbuf.o)
 

module/compat/.pfk_pcb.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_pcb.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/net/inet6_hashtables.h \
 
 compat/pfk_pcb.o: $(deps_compat/pfk_pcb.o)

module/compat/.pfk_rtable.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_rtable.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/pfk_rtable.o: $(deps_compat/pfk_rtable.o)
 

module/compat/.pfk_xmit.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/pfk_xmit.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   include/pfk_api.h \
 
 compat/pfk_xmit.o: $(deps_compat/pfk_xmit.o)

module/compat/.radix.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/radix.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/radix.o: $(deps_compat/radix.o)
 

module/compat/.sha2.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/sha2.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/sha2.o: $(deps_compat/sha2.o)
 

module/compat/.siphash.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/siphash.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/siphash.o: $(deps_compat/siphash.o)
 

module/compat/.subr_tree.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/subr_tree.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 compat/subr_tree.o: $(deps_compat/subr_tree.o)
 

module/compat/.toeplitz.o.cmd

@@ -1828,6 +1828,8 @@ deps_compat/toeplitz.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/crypto/hash.h \
   /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/crypto.h \
 

module/compat/pfk_ifq.c

@@ -217,10 +217,14 @@ pfk_pfq_enqueue(void *arg, struct mbuf *m)
 	struct pfk_pfq *pfq = arg;
 
 	if (!pfq)
-		return NULL;
-	if (ifq_enqueue(&pfq->ifq, m) != 0)
-		return NULL;
-	return m;
+		return m;			/* caller keeps ownership */
+	/*
+	 * ifq_enqueue takes ownership of m (the scheduler may drop it); we then
+	 * drain immediately, so nothing is returned for the caller to send.
+	 */
+	ifq_enqueue(&pfq->ifq, m);
+	ifq_start(&pfq->ifq);
+	return NULL;
 }
 
 static struct mbuf *
@@ -303,7 +307,13 @@ ifq_attach(struct ifqueue *ifq, const struct ifq_ops *ops, void *opsarg)
 	if (!opsarg && ops->ifqop_alloc)
 		opsarg = ops->ifqop_alloc(0, NULL);
 	ifq->ifq_ops = ops;
+	/*
+	 * The port's own helpers use ifq_softc; the staged OpenBSD schedulers
+	 * (hfsc/fq_codel) read ifq->ifq_q.  Keep both in sync or the back ends
+	 * dereference a NULL scheduler state.
+	 */
 	ifq->ifq_softc = opsarg;
+	ifq->ifq_q = opsarg;
 }
 
 /*
@@ -336,19 +346,35 @@ ifq_destroy(struct ifqueue *ifq)
 		ifq->ifq_ops->ifqop_free(0, ifq->ifq_softc);
 	ifq->ifq_ops = NULL;
 	ifq->ifq_softc = NULL;
+	ifq->ifq_q = NULL;
 }
 
+/*
+ * ifqop_enq returns the packet the scheduler decided to DROP (possibly the one
+ * just offered), and NULL when the packet was accepted - it is NOT an error
+ * code.  Freeing the returned mbuf is this layer's job.
+ */
 int
 ifq_enqueue(struct ifqueue *ifq, struct mbuf *m)
 {
-	if (!ifq->ifq_ops || !ifq->ifq_ops->ifqop_enq)
+	struct mbuf *dm;
+
+	if (!ifq->ifq_ops || !ifq->ifq_ops->ifqop_enq) {
+		m_freem(m);
 		return EINVAL;
+	}
 	if (ifq->ifq_maxlen && ifq->ifq_len >= ifq->ifq_maxlen) {
 		ifq->ifq_errors++;
 		ifq->ifq_qdrops++;
+		m_freem(m);
 		return ENOBUFS;
 	}
-	return ifq->ifq_ops->ifqop_enq(ifq, m) ? 0 : ENOMEM;
+	dm = ifq->ifq_ops->ifqop_enq(ifq, m);
+	if (dm) {
+		ifq->ifq_qdrops++;
+		m_freem(dm);
+	}
+	return 0;
 }
 
 struct mbuf *
@@ -402,9 +428,12 @@ void
 ifq_start(struct ifqueue *ifq)
 {
 	struct mbuf *m;
+	int n;
 
+	n = 0;
 	ifq->ifq_oactive = 1;
 	while ((m = ifq_dequeue(ifq)) != NULL) {
+		n++;
 		if (pfk_ifq_transmit(ifq, m))
 			break;			/* device busy: packet kept */
 	}
@@ -423,6 +452,8 @@ pf_kifq_input(struct pfk_ifnet *ifp, struct mbuf *m)
 
 	if (ifp == NULL || m == NULL)
 		return 0;
+	if (ifp == NULL)
+		return 0;
 	ifq = &ifp->if_snd;
 	if (ifq->ifq_ops == NULL || ifq->ifq_ops == ifq_priq_ops)
 		return 0;			/* no scheduler: fast path */

module/compat/pfk_kern.c

@@ -47,8 +47,21 @@ pfk_printk_compat(const char *fmt, ...)
 void
 splassert_fail(int expected, int actual, const char *func)
 {
-	pr_err("splassert: %s: expected %d, got %d\n", func, expected, actual);
-	BUG();
+	/*
+	 * PFLINUX: OpenBSD's splassert() checks a per-CPU spl level, so
+	 * "assert unlocked" really means "this context did not take the lock".
+	 * The port replaced spl with rw-semas plus work queues, where
+	 * rw_status() is a global counter: an assert-unlocked in a work-queue
+	 * task fires whenever *another* CPU happens to hold the lock, which is
+	 * not a bug (the task never acquires pf_lock itself) and was turning a
+	 * harmless race into a kernel BUG() that wedged the module in
+	 * "Unloading".  Report it once instead of killing the host; the
+	 * structural invariant the BSD assert protects - purge never runs while
+	 * holding pf_lock - is upheld by the call sites (pf_purge_* are only
+	 * reached from systqmp tasks and timer work).
+	 */
+	pr_warn_ratelimited("pfk: splassert: %s: expected %d, got %d\n",
+	    func, expected, actual);
 }
 
 /* ---------------- addlog (OpenBSD kern.log) ---------------- */

module/include/net/fq_codel.h

@@ -0,0 +1,51 @@
+/* $OpenBSD: fq_codel.h,v 1.4 2020/06/18 23:29:59 dlg Exp $ */
+
+/*
+ * Copyright (c) 2017 Mike Belopuhov
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _NET_FQ_CODEL_H_
+#define _NET_FQ_CODEL_H_
+
+/* compatible with hfsc_pktcntr */
+struct fqcodel_pktcntr {
+	uint64_t		packets;
+	uint64_t		bytes;
+};
+
+struct fqcodel_stats {
+	struct fqcodel_pktcntr 	xmit_cnt;
+	struct fqcodel_pktcntr 	drop_cnt;
+
+	uint32_t		qlength;
+	uint32_t		qlimit;
+
+	uint32_t		flows;
+	uint32_t		_unused;   /* padding */
+
+	uint32_t		target;
+	uint32_t		interval;
+
+	/* the values below are used to calculate standard deviation */
+	uint64_t		delaysum;  /* sum of delays, us */
+	uint64_t		delaysumsq;/* sum of squared delays, us */
+};
+
+#ifdef _KERNEL
+extern const struct ifq_ops * const ifq_fqcodel_ops;
+extern const struct pfq_ops * const pfq_fqcodel_ops;
+#endif	/* _KERNEL */
+
+#endif	/* _NET_FQ_CODEL_H_ */

module/include/net/hfsc.h

@@ -0,0 +1,122 @@
+/*	$OpenBSD: hfsc.h,v 1.15 2026/03/19 14:59:05 sthen Exp $	*/
+
+/*
+ * Copyright (c) 2012-2013 Henning Brauer <henning@openbsd.org>
+ * Copyright (c) 1997-1999 Carnegie Mellon University. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software and
+ * its documentation is hereby granted (including for commercial or
+ * for-profit use), provided that both the copyright notice and this
+ * permission notice appear in all copies of the software, derivative
+ * works, or modified versions, and any portions thereof.
+ *
+ * THIS SOFTWARE IS EXPERIMENTAL AND IS KNOWN TO HAVE BUGS, SOME OF
+ * WHICH MAY HAVE SERIOUS CONSEQUENCES.  CARNEGIE MELLON PROVIDES THIS
+ * SOFTWARE IN ITS ``AS IS'' CONDITION, AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Carnegie Mellon encourages (but does not require) users of this
+ * software to return any improvements or extensions that they make,
+ * and to grant Carnegie Mellon the rights to redistribute these
+ * changes without encumbrance.
+ */
+#ifndef _HFSC_H_
+#define	_HFSC_H_
+
+/* hfsc class flags */
+#define	HFSC_DEFAULTCLASS	0x1000	/* default class */
+
+struct hfsc_pktcntr {
+	u_int64_t	packets;
+	u_int64_t	bytes;
+};
+
+#define	PKTCNTR_INC(cntr, len)	\
+	do { (cntr)->packets++; (cntr)->bytes += len; } while (0)
+
+struct hfsc_sc {
+	u_int64_t	m1;	/* slope of the first segment in bits/sec */
+	u_int64_t	m2;	/* slope of the second segment in bits/sec */
+	u_int		d;	/* the x-projection of the first segment in msec */
+};
+
+/* special class handles */
+#define	HFSC_ROOT_CLASS		0x10000
+#define	HFSC_DEFAULT_CLASSES	64
+#define	HFSC_MAX_CLASSES	65535
+
+/* service curve types */
+#define	HFSC_REALTIMESC		1
+#define	HFSC_LINKSHARINGSC	2
+#define	HFSC_UPPERLIMITSC	4
+#define	HFSC_DEFAULTSC		(HFSC_REALTIMESC|HFSC_LINKSHARINGSC)
+
+struct hfsc_class_stats {
+	struct hfsc_pktcntr	xmit_cnt;
+	struct hfsc_pktcntr	drop_cnt;
+
+	u_int			qlength;
+	u_int			qlimit;
+	u_int			period;
+
+	u_int			class_id;
+	u_int32_t		class_handle;
+	struct hfsc_sc		rsc;
+	struct hfsc_sc		fsc;
+	struct hfsc_sc		usc;	/* upper limit service curve */
+
+	u_int64_t		total;	/* total work in bytes */
+	u_int64_t		cumul;	/* cumulative work in bytes
+					   done by real-time criteria */
+	u_int64_t		d;		/* deadline */
+	u_int64_t		e;		/* eligible time */
+	u_int64_t		vt;		/* virtual time */
+	u_int64_t		f;		/* fit time for upper-limit */
+
+	/* info helpful for debugging */
+	u_int64_t		initvt;		/* init virtual time */
+	u_int64_t		vtoff;		/* cl_vt_ipoff */
+	u_int64_t		cvtmax;		/* cl_maxvt */
+	u_int64_t		myf;		/* cl_myf */
+	u_int64_t		cfmin;		/* cl_mincf */
+	u_int64_t		cvtmin;		/* cl_mincvt */
+	u_int64_t		myfadj;		/* cl_myfadj */
+	u_int64_t		vtadj;		/* cl_vtadj */
+	u_int64_t		cur_time;
+	u_int32_t		machclk_freq;
+
+	u_int			vtperiod;	/* vt period sequence no */
+	u_int			parentperiod;	/* parent's vt period seqno */
+	int			nactive;	/* number of active children */
+
+	/* red and rio related info */
+	int			qtype;
+/*	struct redstats		red[3]; */
+};
+
+#ifdef _KERNEL
+struct ifnet;
+struct ifqueue;
+struct pf_queuespec;
+struct hfsc_if;
+
+extern const struct ifq_ops * const ifq_hfsc_ops;
+extern const struct pfq_ops * const pfq_hfsc_ops;
+
+#define	HFSC_ENABLED(ifq)	((ifq)->ifq_ops == ifq_hfsc_ops)
+#define	HFSC_DEFAULT_QLIMIT	50
+
+void		 hfsc_initialize(void);
+
+#endif /* _KERNEL */
+#endif /* _HFSC_H_ */

module/include/pfk.h

@@ -1214,62 +1214,18 @@ struct pfk_pflog_stat {
 
 
 /*
- * Pieces the staged scheduler back ends (fq_codel(4)/hfsc(4) ports) need from
- * OpenBSD <net/if_var.h>, <net/if_fq_codel.h> and <net/if_hfsc.h>.
+ * Scheduler back-end ABI: the very headers OpenBSD ships (net/hfsc.h,
+ * net/fq_codel.h), vendored into the port so that pfctl and pf.ko agree on the
+ * stats layouts and on the class-handle/service-curve constants.  (Hand-rolled
+ * approximations of these structs made DIOCGETQSTATS fail with EINVAL, because
+ * pfctl's sizeof(struct hfsc_class_stats) did not match the kernel's.)
  */
 #ifndef nsecuptime
 #define nsecuptime()	 getnsecuptime()
 #endif
 
-struct fqcodel_pktcntr { uint64_t packets; uint64_t bytes; };
-struct hfsc_pktcntr	 { uint64_t packets; uint64_t bytes; };
-
-struct fqcodel_stats {
-	struct fqcodel_pktcntr xmit_cnt;
-	struct fqcodel_pktcntr drop_cnt;
-	uint32_t	 target, interval, tc_interval_drop;
-	uint32_t	 rcvtime, mtu, qlimit, qlength;
-	uint64_t	 delaysum, delaysumsq;
-	uint8_t		 ecn, limit, flows, lscroll, flags;
-};
-
-/* ifq scheduler hand-off (see pfsrc/ifq.c): enter returns the scheduler's
- * queue when it owns the interface queue, NULL otherwise. */
-void	*ifq_q_enter(struct ifqueue *, const struct ifq_ops *);
-void	 ifq_q_leave(struct ifqueue *, void *);
-int	 pfk_ifq_transmit(struct ifqueue *, struct mbuf *);
-int	 pf_kifq_input(struct pfk_ifnet *, struct mbuf *);
-
-
-/*
- * OpenBSD <net/if_hfsc.h> pieces the staged hfsc(4) back end needs.
- * PFLINUX: the port keeps the BSD scheduler sources verbatim, so the
- * user-visible service curve, the class-stats record and the class-table
- * limits live here instead of in a separate kernel header.
- */
-struct hfsc_sc {				/* user-supplied service curve */
-	u_int64_t	m1;			/* slope1 (bytes/sec) */
-	u_int64_t	d;			/* ordinate of the knee (us) */
-	u_int64_t	m2;			/* slope2 (bytes/sec) */
-};
-
-struct hfsc_class_stats {
-	u_int		class_id;
-	u_int32_t	class_handle;
-	struct hfsc_sc	rsc, fsc, usc;
-	u_int64_t	total, cumul;
-	u_int64_t	d, e, vt, f;
-	u_int64_t	initvt, vtperiod, parentperiod;
-	int		nactive;
-	u_int64_t	vtoff, cvtmax, myf, cfmin, cvtmin, myfadj, vtadj;
-	u_int		period;
-	struct hfsc_pktcntr xmit_cnt, drop_cnt;
-	u_int64_t	cur_time;
-	u_int64_t	machclk_freq;
-	int		qlength;
-	int		qlimit;
-	int		qtype;
-};
+#include <net/hfsc.h>
+#include <net/fq_codel.h>
 
 /* OpenBSD's global nanoseconds-per-clocktick (HFSC_CLK_PER_TICK).  The port
  * has no clock_rate machinery, so derive it from the kernel's HZ. */
@@ -1277,18 +1233,13 @@ struct hfsc_class_stats {
 #define tick_nsec		(1000000000LL / HZ)
 #endif
 
-/*
- * Class-handle namespace.  pf queue ids are u_int16_t, so the root class gets
- * a high bit that can never collide with a queue handle (a collision made
- * hfsc_pf_addqueue() see the root class as a duplicate and refuse the queue
- * with EBUSY).  HFSC_DEFAULTCLASS must equal PFQS_DEFAULT because hfsc.c
- * receives the pf queue flags verbatim.
- */
-#define HFSC_ROOT_CLASS		0x80000000u
-#define HFSC_DEFAULTCLASS	0x1000
-#define HFSC_MAX_CLASSES	64
-#define HFSC_DEFAULT_CLASSES	8
-#define HFSC_DEFAULT_QLIMIT	1000
+/* ifq scheduler hand-off (see pfsrc/ifq.c): enter returns the scheduler's
+ * queue state when it owns the interface queue, NULL otherwise. */
+void	*ifq_q_enter(struct ifqueue *, const struct ifq_ops *);
+void	 ifq_q_leave(struct ifqueue *, void *);
+int	 pfk_ifq_transmit(struct ifqueue *, struct mbuf *);
+int	 pf_kifq_input(struct pfk_ifnet *, struct mbuf *);
+
 
 /*
  * PFLINUX notes on the scheduler back ends:
@@ -1299,16 +1250,13 @@ struct hfsc_class_stats {
  *   are kept as markers of the critical regions.
  * - KERNEL_ASSERT_LOCKED(): the schedulers are only reached from ifq/pf paths
  *   that already hold the queue mutex; asserted structurally, not by spl.
- * - HFSC_ENABLED(): the scheduler owns the interface queue once it attached
- *   its private state through ifq_q_enter().
+ * - HFSC_ENABLED(), PKTCNTR_INC(), the class-handle constants and the stats
+ *   layouts all come from the vendored net/hfsc.h / net/fq_codel.h above, so
+ *   kernel and pfctl cannot drift apart.
  */
 #define splnet()		0
 #define splx(s)			((void)(s))
 #define KERNEL_ASSERT_LOCKED()	do { } while (0)
-#define HFSC_ENABLED(_ifq)	((_ifq)->ifq_q != NULL)
-
-#define PKTCNTR_INC(_c, _len)	do { (_c)->packets++; (_c)->bytes += (_len); } \
-				  while (0)
 
 #endif /* _PFK_H */
 

module/pfsrc/.divert_sock.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/divert_sock.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   include/pfk_api.h \
 
 pfsrc/divert_sock.o: $(deps_pfsrc/divert_sock.o)

module/pfsrc/.fq_codel.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/fq_codel.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/fq_codel.o: $(deps_pfsrc/fq_codel.o)
 

module/pfsrc/.hfsc.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/hfsc.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/hfsc.o: $(deps_pfsrc/hfsc.o)
 

module/pfsrc/.pf.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf.o: $(deps_pfsrc/pf.o)
 

module/pfsrc/.pf_if.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_if.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_if.o: $(deps_pfsrc/pf_if.o)
 

module/pfsrc/.pf_ioctl.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_ioctl.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_ioctl.o: $(deps_pfsrc/pf_ioctl.o)
 

module/pfsrc/.pf_lb.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_lb.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_lb.o: $(deps_pfsrc/pf_lb.o)
 

module/pfsrc/.pf_norm.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_norm.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_norm.o: $(deps_pfsrc/pf_norm.o)
 

module/pfsrc/.pf_osfp.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_osfp.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_osfp.o: $(deps_pfsrc/pf_osfp.o)
 

module/pfsrc/.pf_ruleset.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_ruleset.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_ruleset.o: $(deps_pfsrc/pf_ruleset.o)
 

module/pfsrc/.pf_syncookies.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_syncookies.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_syncookies.o: $(deps_pfsrc/pf_syncookies.o)
 

module/pfsrc/.pf_table.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pf_table.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
 
 pfsrc/pf_table.o: $(deps_pfsrc/pf_table.o)
 

module/pfsrc/.pfk_hooks.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pfk_hooks.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   include/pfk_api.h \
 
 pfsrc/pfk_hooks.o: $(deps_pfsrc/pfk_hooks.o)

module/pfsrc/.pfk_mod.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pfk_mod.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   include/pfk_api.h \
 
 pfsrc/pfk_mod.o: $(deps_pfsrc/pfk_mod.o)

module/pfsrc/.pfk_pflog.o.cmd

@@ -1828,6 +1828,8 @@ deps_pfsrc/pfk_pflog.o := \
   include/compat/sys/rwlock.h \
   include/compat/sys/mutex.h \
   include/compat/sys/pclock.h \
+  include/net/hfsc.h \
+  include/net/fq_codel.h \
   include/pfk_api.h \
 
 pfsrc/pfk_pflog.o: $(deps_pfsrc/pfk_pflog.o)

module/pfsrc/hfsc.c

@@ -481,7 +481,16 @@ hfsc_pf_qstats(struct pf_queuespec *q, void *ubuf, int *nbytes)
 	if (hif == NULL)
 		return (EBADF);
 
-	if ((cl = hfsc_clh2cph(hif, q->qid)) == NULL) {
+	/*
+	 * A root queue's class is created with handle HFSC_ROOT_CLASS | qid
+	 * (see hfsc_pf_addqueue), so looking the queue up by its plain pf qid
+	 * only finds non-root classes: fall back to the root handle, otherwise
+	 * "pfctl -s queue" fails with EINVAL on the first (root) queue.
+	 */
+	if ((cl = hfsc_clh2cph(hif, q->qid)) == NULL &&
+	    (q->flags & PFQS_ROOTCLASS))
+		cl = hfsc_clh2cph(hif, HFSC_ROOT_CLASS | q->qid);
+	if (cl == NULL) {
 		ifq_q_leave(&ifp->if_snd, hif);
 		return (EINVAL);
 	}

module/pfsrc/pfk_pflog.c

@@ -115,11 +115,22 @@ pfk_pflog_pull(struct mbuf *m, char *buf, size_t want)
 {
 	struct sk_buff *skb = m ? m_to_skb(m) : NULL;
 	size_t n;
+	int off;
 
 	if (skb == NULL)
 		return 0;
-	n = min_t(size_t, want, skb->len);
-	if (skb_copy_bits(skb, 0, buf, n))
+	/*
+	 * BSD logs from the network header; pf may already have advanced the
+	 * mbuf/skb data pointer to the transport header while parsing, so
+	 * anchor explicitly at the IP header instead of at skb->data.
+	 */
+	off = skb_network_offset(skb);
+	if (off < 0)
+		off = 0;
+	if (off > skb->len)
+		return 0;
+	n = min_t(size_t, want, skb->len - off);
+	if (skb_copy_bits(skb, off, buf, n))
 		return 0;
 	return n;
 }