M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics

- hooks: packets are queued to pfk_netisr ordered wq (process context) and
  re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
  documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)

tests/vm/01-state.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# M2 gate 1: default policy pass + stateful transit + state visibility
+set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
+pf0 'rmmod pf 2>/dev/null; insmod /tmp/pf.ko; /opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null; echo READY' | grep -q READY || { bad load; finish; }
+pf0 'echo "pass in quick proto icmp keep state
+pass out quick proto icmp keep state" | /opt/pf/pfctl -f -' || bad rules
+cli "ping -c 3 -W 2 $SRV_IP >/dev/null 2>&1" && ok "transit ping" || bad "transit ping"
+N=$(pf0 '/opt/pf/pfctl -s states | grep -c icmp'); [ "${N:-0}" -ge 1 ] && ok "icmp state present ($N)" || bad "no state"
+pf0 '/opt/pf/pfctl -d' >/dev/null; finish

tests/vm/02-block.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# M2 gate 2: block drop + block return-rst verified at packet level
+set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
+pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
+pf0 'echo "block drop in quick proto icmp from any to any
+pass out quick" | /opt/pf/pfctl -f -'
+cli "ping -c 2 -W 1 $SRV_IP >/dev/null 2>&1" && bad "icmp still passes" || ok "icmp blocked"
+# return-rst on tcp: cli nc to closed-filtered port expects RST back
+pf0 'echo "block return-rst in quick proto tcp from any to any port 8080
+pass out quick" | /opt/pf/pfctl -f -'
+srv 'timeout 3 nc -l -p 8080 >/dev/null 2>&1 &' ; sleep 0
+cli 'timeout 3 nc -z 10.0.2.20 8080; echo NC=$?' | grep -q 'NC=1' && ok "tcp refused (rst)" || bad "tcp not refused"
+pf0 '/opt/pf/pfctl -d' >/dev/null; finish

tests/vm/03-tables.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# M2 gate 3: pfr tables via pfctl -t
+set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
+pf0 '/opt/pf/pfctl -e' >/dev/null
+pf0 'printf "block in quick proto icmp from <blk>\npass out quick\n" | /opt/pf/pfctl -f -'
+pf0 '/opt/pf/pfctl -t blk -T add 10.0.1.10' && ok "table add"
+M=$(pf0 '/opt/pf/pfctl -t blk -T show | grep -c 10.0.1.10'); [ "$M" -ge 1 ] && ok "table shows entry" || bad "table empty"
+cli "ping -c1 -W1 $SRV_IP >/dev/null 2>&1" && bad "blocked src passed" || ok "table block works"
+pf0 "/opt/pf/pfctl -t blk -T kill 10.0.1.10" >/dev/null
+cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "unblocked passes" || bad "kill failed"
+pf0 '/opt/pf/pfctl -d' >/dev/null; finish

tests/vm/04-anchors.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# M2 gate 4: anchors + quick precedence
+set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
+pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
+pf0 'printf "pass in quick\nanchor \"x\"\nblock drop in quick proto icmp keep first\n" > /tmp/a.conf'
+pf0 '/opt/pf/pfctl -f /tmp/a.conf' >/dev/null
+pf0 'echo "pass in quick proto icmp from 10.0.1.10 to any" | /opt/pf/pfctl -a x -f -' && ok "anchor load"
+cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor rule evaluated before block" || bad "anchor pass not honored"
+pf0 '/opt/pf/pfctl -s Anchors | grep -q x' && ok "anchors listed" || bad "anchor list"
+pf0 '/opt/pf/pfctl -d' >/dev/null; finish

tests/vm/lib.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# helpers for tests/vm/*
+DEB="${DEB:-root@192.168.1.242}"
+PF0_IP="${PF0_IP:-192.168.122.8}"
+CLI_IP=10.0.1.10; SRV_IP=10.0.2.20; GW2_IP=10.0.3.2; GW2_WAN=10.0.2.2
+pf0() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"$*\"" ; }
+cli() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"ssh -o StrictHostKeyChecking=accept-new root@$CLI_IP '$*'\"" ; }
+srv() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"ssh -o StrictHostKeyChecking=accept-new root@$SRV_IP '$*'\"" ; }
+ok()   { echo "OK $*"; }
+bad()  { echo "NOT OK: $*" >&2; FAILED=1; }
+finish(){ [ "${FAILED:-0}" = 1 ] && exit 1; exit 0; }