M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

lab/domains/pftest-cli.xml.tmpl

@@ -0,0 +1,49 @@
+<domain type='kvm'>
+  <name>@NAME@</name>
+  <memory unit='MiB'>@VM_MEM_MB@</memory>
+  <vcpu>@VM_VCPUS@</vcpu>
+  <cpu mode='host-passthrough' check='partial'/>
+  <os>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <boot dev='hd'/>
+@KERNELBLOCK@
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+  </features>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2'/>
+      <source file='@DISK@'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <disk type='file' device='cdrom'>
+      <driver name='qemu' type='raw'/>
+      <source file='@SEED@'/>
+      <target dev='sda' bus='sata'/>
+      <readonly/>
+    </disk>
+    <interface type='network'>
+      <mac address='@CLI_MAC_MGMT@'/>
+      <source network='@MGMT_NET@'/>
+      <model type='virtio'/>
+    </interface>
+    <interface type='network'>
+      <mac address='@CLI_MAC_LAN@'/>
+      <source network='@NET_PF_LAN@'/>
+      <model type='virtio'/>
+    </interface>
+    <serial type='pty'>
+      <target type='isa-serial' port='0'><model name='isa-serial'/></target>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>

lab/domains/pftest-gw2.xml.tmpl

@@ -0,0 +1,50 @@
+<!-- gw2: no mgmt NIC by contract; reachable from deb via pf-wan2 bridge IP -->
+<domain type='kvm'>
+  <name>@NAME@</name>
+  <memory unit='MiB'>@VM_MEM_MB@</memory>
+  <vcpu>@VM_VCPUS@</vcpu>
+  <cpu mode='host-passthrough' check='partial'/>
+  <os>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <boot dev='hd'/>
+@KERNELBLOCK@
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+  </features>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2'/>
+      <source file='@DISK@'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <disk type='file' device='cdrom'>
+      <driver name='qemu' type='raw'/>
+      <source file='@SEED@'/>
+      <target dev='sda' bus='sata'/>
+      <readonly/>
+    </disk>
+    <interface type='network'>
+      <mac address='@GW2_MAC_WAN@'/>
+      <source network='@NET_PF_WAN@'/>
+      <model type='virtio'/>
+    </interface>
+    <interface type='network'>
+      <mac address='@GW2_MAC_WAN2@'/>
+      <source network='@NET_PF_WAN2@'/>
+      <model type='virtio'/>
+    </interface>
+    <serial type='pty'>
+      <target type='isa-serial' port='0'><model name='isa-serial'/></target>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>

lab/domains/pftest-pf0.xml.tmpl

@@ -0,0 +1,59 @@
+<domain type='kvm'>
+  <name>@NAME@</name>
+  <memory unit='MiB'>@VM_MEM_MB@</memory>
+  <vcpu>@VM_VCPUS@</vcpu>
+  <cpu mode='host-passthrough' check='partial'/>
+  <os>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <boot dev='hd'/>
+@KERNELBLOCK@
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+  </features>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2'/>
+      <source file='@DISK@'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <disk type='file' device='cdrom'>
+      <driver name='qemu' type='raw'/>
+      <source file='@SEED@'/>
+      <target dev='sda' bus='sata'/>
+      <readonly/>
+    </disk>
+    <interface type='network'>
+      <mac address='@PF0_MAC_MGMT@'/>
+      <source network='@MGMT_NET@'/>
+      <model type='virtio'/>
+    </interface>
+    <interface type='network'>
+      <mac address='@PF0_MAC_LAN@'/>
+      <source network='@NET_PF_LAN@'/>
+      <model type='virtio'/>
+    </interface>
+    <interface type='network'>
+      <mac address='@PF0_MAC_WAN@'/>
+      <source network='@NET_PF_WAN@'/>
+      <model type='virtio'/>
+    </interface>
+    <interface type='network'>
+      <mac address='@PF0_MAC_WAN2@'/>
+      <source network='@NET_PF_WAN2@'/>
+      <model type='virtio'/>
+    </interface>
+    <serial type='pty'>
+      <target type='isa-serial' port='0'><model name='isa-serial'/></target>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>

lab/domains/pftest-srv.xml.tmpl

@@ -0,0 +1,49 @@
+<domain type='kvm'>
+  <name>@NAME@</name>
+  <memory unit='MiB'>@VM_MEM_MB@</memory>
+  <vcpu>@VM_VCPUS@</vcpu>
+  <cpu mode='host-passthrough' check='partial'/>
+  <os>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <boot dev='hd'/>
+@KERNELBLOCK@
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+  </features>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2'/>
+      <source file='@DISK@'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <disk type='file' device='cdrom'>
+      <driver name='qemu' type='raw'/>
+      <source file='@SEED@'/>
+      <target dev='sda' bus='sata'/>
+      <readonly/>
+    </disk>
+    <interface type='network'>
+      <mac address='@SRV_MAC_MGMT@'/>
+      <source network='@MGMT_NET@'/>
+      <model type='virtio'/>
+    </interface>
+    <interface type='network'>
+      <mac address='@SRV_MAC_WAN@'/>
+      <source network='@NET_PF_WAN@'/>
+      <model type='virtio'/>
+    </interface>
+    <serial type='pty'>
+      <target type='isa-serial' port='0'><model name='isa-serial'/></target>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>