AF_DIVERT family restored & compiling: full socket family (PF_DIVERT=32, sock_register), blocking recv/poll, divert_output-compatible sendmsg reinject, mtag type passthrough; pfk_api decls

tests/vm/01-state.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # M2 gate 1: stateful transit + state visibility
 set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
-pfensure
+pf0 'insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true'
 pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null; echo READY' | grep -q READY || { bad load; finish; }
 cat > /tmp/g1.conf <<'C'
 pass in quick proto icmp keep state

tests/vm/02-block.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # M2 gate 2: block drop + block return-rst
 set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
-pfensure; pf0 '/opt/pf/pfctl -e' >/dev/null
+pf0 'insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true'; pf0 '/opt/pf/pfctl -e' >/dev/null
 cat > /tmp/g2a.conf <<'C'
 block drop in quick proto icmp from any to any
 pass out quick

tests/vm/03-tables.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # M2 gate 3: pfr tables via pfctl -t
 set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
-pfensure; pf0 '/opt/pf/pfctl -e' >/dev/null
+pf0 'insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true'; pf0 '/opt/pf/pfctl -e' >/dev/null
 cat > /tmp/g3.conf <<'C'
 table <blk> { 10.0.1.10 }
 block in quick proto icmp from <blk> to any

tests/vm/04-anchors.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # M2 gate 4: anchors + quick precedence
 set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
-pfensure; pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
+pf0 'insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true'; pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
 cat > /tmp/g4main.conf <<'C'
 anchor "restricted"
 block drop in quick proto icmp from any to any