fix: skb->mark masks were multi-bit (IN mark matched OUT test) - transit traffic never reached the out ruleset; ingress/egress interface groups; pfctl resolves (egress) pool locally

module/include/pfk_api.h

@@ -7,7 +7,7 @@
 long pfk_ioctl(struct file *f, unsigned int cmd, unsigned long addr);
 int  pfk_enable(int on);
 void pfk_status(struct pf_status *s);
-#define PFK_SKIP_PF	0x50460040u	/* skb->mark: reinjected, bypass pf */
+#define PFK_SKIP_PF	0x00000004u	/* skb->mark: reinjected, bypass pf */
 
 int  pfk_hooks_register(void);
 void pfk_hooks_unregister(void);