pf-linux-port/docs/porting-notes.md

2026-11-11T11:42:59-03:00 staging

stage: headers + skeletons

2026-11-11T11:43:18-03:00 staging

stage: headers + skeletons

2026-11-11T11:51:34-03:00 staging

stage: headers + skeletons

2026-11-11T11:52:34-03:00 staging

stage: headers + skeletons

2026-11-11T12:08:01-03:00 staging

port_c net/pf.c -> pfsrc/pf.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_ruleset.c -> pfsrc/pf_ruleset.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_table.c -> pfsrc/pf_table.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_osfp.c -> pfsrc/pf_osfp.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/radix.c -> compat/radix.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/rtable.c -> compat/rtable.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c crypto/sha2.c -> compat/sha2.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/ifq.c -> pfsrc/ifq.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/hfsc.c -> pfsrc/hfsc.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/fq_codel.c -> pfsrc/fq_codel.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c net/if_pflog.c -> pfsrc/if_pflog.c.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:08:01-03:00 staging

port_c netinet/ip_divert.c -> pfsrc/ip_divert.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:17:54-03:00 staging

port_c crypto/md5.c -> compat/md5.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:17:54-03:00 staging

port_c crypto/sha2.c -> compat/sha2.c (includes→pfk.h; struct renames; sa_len nulled)

2026-11-11T12:22:35-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_ruleset.c -> pfsrc/pf_ruleset.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_table.c -> pfsrc/pf_table.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_osfp.c -> pfsrc/pf_osfp.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/ifq.c -> pfsrc/ifq.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/hfsc.c -> pfsrc/hfsc.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/fq_codel.c -> pfsrc/fq_codel.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c net/if_pflog.c -> pfsrc/if_pflog.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c netinet/ip_divert.c -> pfsrc/ip_divert.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c crypto/md5.c -> compat/md5.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:22:35-03:00 staging

port_c crypto/sha2.c -> compat/sha2.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:23:13-03:00 staging

port_c net/radix.c -> compat/radix.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:23:13-03:00 staging

port_c net/rtable.c -> compat/rtable.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:31:22-03:00 staging

stage: headers + skeletons

2026-11-11T12:33:23-03:00 staging

stage: headers + skeletons

2026-11-11T12:33:35-03:00 staging

stage: headers + skeletons

2026-11-11T12:35:29-03:00 staging

stage: headers + skeletons

2026-11-11T12:36:13-03:00 staging

stage: headers + skeletons

2026-11-11T12:38:18-03:00 staging

port_c net/radix.c -> compat/radix.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:38:18-03:00 staging

port_c net/rtable.c -> compat/rtable.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:39:29-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:39:29-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_ruleset.c -> pfsrc/pf_ruleset.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_table.c -> pfsrc/pf_table.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_osfp.c -> pfsrc/pf_osfp.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/ifq.c -> pfsrc/ifq.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/hfsc.c -> pfsrc/hfsc.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/fq_codel.c -> pfsrc/fq_codel.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c net/if_pflog.c -> pfsrc/if_pflog.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c netinet/ip_divert.c -> pfsrc/ip_divert.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c crypto/md5.c -> compat/md5.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:42:35-03:00 staging

port_c crypto/sha2.c -> compat/sha2.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:10-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:10-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_ruleset.c -> pfsrc/pf_ruleset.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_table.c -> pfsrc/pf_table.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_osfp.c -> pfsrc/pf_osfp.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/ifq.c -> pfsrc/ifq.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/hfsc.c -> pfsrc/hfsc.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/fq_codel.c -> pfsrc/fq_codel.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c net/if_pflog.c -> pfsrc/if_pflog.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:11-03:00 staging

port_c netinet/ip_divert.c -> pfsrc/ip_divert.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_ruleset.c -> pfsrc/pf_ruleset.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_table.c -> pfsrc/pf_table.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_osfp.c -> pfsrc/pf_osfp.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/ifq.c -> pfsrc/ifq.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/hfsc.c -> pfsrc/hfsc.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/fq_codel.c -> pfsrc/fq_codel.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c net/if_pflog.c -> pfsrc/if_pflog.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:43:44-03:00 staging

port_c netinet/ip_divert.c -> pfsrc/ip_divert.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:49:48-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:56:45-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:56:46-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:56:46-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:56:46-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:56:46-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:57:50-03:00 staging

stage: headers + skeletons

2026-11-11T12:57:50-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped->pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_norm.c -> pfsrc/pf_norm.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_lb.c -> pfsrc/pf_lb.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_ruleset.c -> pfsrc/pf_ruleset.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_table.c -> pfsrc/pf_table.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_osfp.c -> pfsrc/pf_osfp.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/ifq.c -> pfsrc/ifq.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/hfsc.c -> pfsrc/hfsc.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/fq_codel.c -> pfsrc/fq_codel.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c net/if_pflog.c -> pfsrc/if_pflog.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c netinet/ip_divert.c -> pfsrc/ip_divert.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c crypto/md5.c -> compat/md5.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

port_c crypto/sha2.c -> compat/sha2.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T12:58:34-03:00 staging

stage: headers

2026-11-11T13:00:24-03:00 staging

port_c net/pf_if.c -> pfsrc/pf_if.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T13:06:14-03:00 staging

port_c net/pf_syncookies.c -> pfsrc/pf_syncookies.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T13:06:41-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T13:14:45-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T13:17:40-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T13:18:44-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T13:25:25-03:00 staging

port_c net/pf_ioctl.c -> pfsrc/pf_ioctl.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T14:05:58-03:00 staging

port_c net/pf.c -> pfsrc/pf.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T14:34:07-03:00 staging

port_c kern/subr_tree.c -> compat/subr_tree.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T14:42:10-03:00 staging

port_c net/radix.c -> compat/radix.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

2026-11-11T14:42:10-03:00 staging

port_c net/rtable.c -> compat/rtable.c (includes dropped -> pfk.h; -D_KERNEL mode; renames)

M1 pf.c compile-port — 2026-11-11: staging sed extensions

• sa_len removal extended to -> accesses (pf.c: dst->sin_len = ...;).
• ip_output( → pfk_ip_output(, ip_forward( → pfk_ip_forward(, ip6_output( → pfk_ip6_output( (Linux net/ip.h/net/dst.h own these names).
• pf_create_state prototype struct pf_src_node ** → struct pf_src_node *[PF_SN_MAX] (GCC -Werror=array-parameter: definition binds [4]).
• kern/subr_tree.c vendored+staged → compat/subr_tree.c (tree.h _rb_* back end was never implemented; upstream OpenBSD file compiles verbatim through port_c). net/rtable.c staged once and dropped again: it is the OpenBSD ART-fib core (srp/domains) and is NOT buildable as a PF compat layer; the port's route view stays in compat/pfk_rtable.c.

M1 PFLINUX deviations (pf.c ↔ compat), each marked in code

• counters: counters_alloc/inc/zero/read/free implemented over the compat cpumem per-CPU u64 slots; counters_read's scratch argument is accepted and unused (OpenBSD walks cpu_info; we sum nr_cpu_ids slots).
• struct inpcb (compat/pfk_pcb.c): one pcb synthesised per successful Linux socket lookup (established/listen/UDP-lib); refs via in_pcbref/in_pcbunref mirror OpenBSD (lookup returns held). inp_socket->so_euid = sock owner uid; so_egid/so_cpid are NOT stored in struct sock by Linux → (gid_t)-1 / NO_PID (pfioc-anchored user/pid matching degrades to uid-only until a lookup-side feature). Wildcard matching: OpenBSD in_pcblookup finds bound-wildcard in one pass; here exact=established + wildcard=in_pcblookup_listen — exactly the sequence pf_socket_lookup already performs.
• if_get/if_get_smr → registry idr lookup (no refcount: pfk_ifnet is RCU-freed on unregister); if_put is a no-op.
• smr_read_enter/leave → rcu_read_lock/unlock.
• if_congested(): OpenBSD gates on the global ifq congestion timestamp; the port stamps the same instant from its xmit path (pfk_if_congestion on ENOBUFS/ENETDOWN/EHOSTUNREACH drops in pfk_xmit.c/pfk_ip4.c).
• ip_forwarding/ip_directedbcast/ipmultipath/ip6_multipath/ip_mtudisc/ ip_defttl: OpenBSD sysctl ints kept as port globals; ip_forwarding is synced from the Linux netns all ipv4 devconf FORWARDING on device events (not instantaneous on sysctl change; values 1/2-ipsec map to 0/1).
• tcp_iss: stays 0; pf_tcp_iss() salt comes from the SHA512 digest + per-call increment, which is what upstream relies on anyway.
• max_linkhdr: default 14, grown from device hard_header_len on refresh.
• ip_output/ip6_output/ip_forward/ip_send/icmp_error/ip_fragment (compat/pfk_ip4.c): BSD semantics, mbuf-consuming. Deviations: no record-route/IP-options processing, no IPsec coupling flags, and NO ICMP-redirect generation when IP_REDIRECT/IPV6_REDIRECT is passed (the Linux FIB emits redirects); ip_fragment always consumed, appended to the mbuf_list.
• csum_flags: driver offload is not trusted yet (M1): ingress packets get no M_TCP_CSUM_IN_OK, pf_check_tcp_cksum recomputes in software; M_TCP_CSUM_OUT/M_UDP_CSUM_OUT are honoured by the port's own output path (pseudo-header checksum computed there).
• ipstat_inc/tcpstat_inc: no-op macros (netinet per-CPU stats are not ported; PF-visible counters live in pf_status/kif only).
• rtable_iterate: always NULL — multipath uRPF iteration is a single Linux-FIB answer (documented).
• rtlabel_name2id/rtlabel_id2name/rtlabel_unref: report "unavailable" (routing labels are a non-goal; ioctl layer rejects labeled rules).
• divert_packet/divert6_packet (pfsrc/divert_sock.c): no AF_DIVERT socket layer exists yet (M6); with no socket attached OpenBSD frees the packet — identical observable behaviour, plus one log line so it is never silent.
• pflog_packet (compat/pfk_kern.c): NPFLOG=1 but if_pflog.c needs the ifpf layer; returns success with a one-time pr_warn "packet not logged" (M4 netlink backend).
• timeout/task: TIMEOUT_INITIALIZER/TASK_INITIALIZER static initializers added; timeout_add/timeout_set lazily complete the Linux timer/work plumbing on first use (BSD statics never call timeout_set()).
• struct pfk_socket/in_ifaddr views: ifatoia/ifatoia6 return port-owned pfk_in_ifaddr/pfk_in6_ifaddr snapshots (Linux owns the in_ifaddr tag); rt_ifa in pfk_rtentry is such a snapshot, freed with the entry.
• counters/atomic: atomic_cas_ptr/atomic_cas_uint return old-value-on- success / 0|NULL-on-failure (OpenBSD) via cmpxchg.
• TCP_NSTATES=11 etc.: constants verified against OpenBSD master headers (tcp_fsm.h, ip_icmp.h, ip6.h, icmp6.h, ip_var.h, ip6_var.h, route.h, in_pcb.h, proc.h); pfk_net.h gained ip6_vfc overlay, ICMP icmp_pptr/ icmp_void/icmp_nextmtu hun fields, icmp6_pptr, ip6_opt/_jumbo/_rthdr, sackblk, ICMP6/MLD/ND type constants.
• pfk.h TCPS_HAVEESTABLISHED corrected to upstream >= TCPS_ESTABLISHED (was <= TCPS_TIME_WAIT, which would have matched LISTEN too).
• pfk_ifq.h/if_var.h: struct ifnet tag replaced by struct pfk_ifnet throughout (upstream struct ifnet is sed-renamed; stale forward declaration broke type identity).
• module/pfsrc/pfk_mod.c + pfk_hooks.c were missing from the tree (HEAD commit deleted them; only stale .o files had kept pf.ko linking). Restored: /dev/pf misc device now dispatches through the staged real pfioctl() with OpenBSD-style copyin/copyout driven by the ioctl size field (PFKIOC_SIZE); netfilter hooks remain accept-all until the M2 data-path task (announced in dmesg).
• pfk_ifnet_new: kzalloc leaves BSD TAILQ heads with tqh_last == NULL; the first pfk_if_addrlist_refresh INSERT_TAIL oopsed on insmod (VM lab). Fixed with TAILQ_INIT of if_addrlist/if_groups (compat/pfk_if.c).

M2 gate fixes — 2026-11-11 (PF-on-Linux port)

Three root causes were found while making the M2 gates (tests/vm/01-state.sh … 04-anchors.sh) pass. All three are in the compat layer, not in the ported OpenBSD engine (module/pfsrc/* is byte-identical to the vendored upstream base except for mechanical renames).

1. module/include/compat/sys/refcnt.h — inverted refcnt_rele() polarity

OpenBSD's refcnt_rele() returns 1 when the last reference is dropped and 0 otherwise (sys/kern/kern_synch.c); PF_REF_RELE() and pf_anchor_rele() depend on that polarity. The port implemented it as "returns the new count", i.e. exactly inverted:

return (refcount_dec_and_test(&r->rc) ? refcnt_value(r) : refcnt_value(r) + 1);

Consequence: every pf_state_unref()/pf_state_key_unref() that was not the last reference took the "last reference" branch and did pool_put() on a live object, while the real last reference was never taken. Symptoms on the VM (kernel console via virsh console):

WARNING: pfsrc/pf.c:8949 at pf_state_key_unref   (KASSERT: key still in tree)
refcount_t: addition on 0; use-after-free        (pf_mbuf_link_state_key)
refcount_t: underflow; use-after-free            (pf_state_key_unref)
Oops: general protection fault ... pf_state_tree_RBT_COMPARE
       (pf_test -> pf_find_state -> _rb_find)

i.e. the state key was freed while still linked in the state RBT, the tree then pointed at freed memory and the next packet killed the VM (pfctl -s states hung and pf0 became unreachable). Fix: return 1 when the count reaches zero.

2. module/include/compat/sys/queue.h — LIST_HEAD had two spellings

compat/sys/queue.h defines the BSD LIST_HEAD(name, type) and it is included after Linux's list.h, so it shadowed Linux's LIST_HEAD(name). The ported engine uses the BSD form (pfsrc/pf_ioctl.c) while the port's own glue uses the Linux form (pfsrc/divert_sock.c, compat/pfk_kern.c, compat/pfk_if.c), so one of them could not compile. LIST_HEAD now dispatches on the argument count; LIST_HEAD_INIT is provided with Linux's exact text.

3. module/compat/radix.c — SALEN() needs the sockaddr length

The vendored BSD radix code takes the key length from the BSD sockaddr.sa_len byte (#define SALEN(sa) (*(u_char *)(sa))). Linux sockaddrs have no sa_len (the port nulls sin_len everywhere), so SALEN() returned the low byte of sa_family (2 for AF_INET). Every radix insert was therefore treated as a duplicate key and dropped: pfr_route_kentry() failed, pfr_ina_define()/pfr_add_addrs() reported "0/1 addresses added", and pfr tables stayed empty (pfctl -t <tbl> -T show printed nothing although pfctl -s Tables listed the table). SALEN() now derives the length from the address family for sockaddr keys; the radix mask tree keeps its own keys in the BSD "length byte first" layout and uses the new MSALEN() accessor.

4. tests/vm/04-anchors.sh — anchor ruleset needs "keep state"

The gate loads

anchor "restricted"            (main ruleset, top)
block drop in quick proto icmp from any to any
pass in quick / pass out quick
# anchor "restricted":
pass in quick proto icmp from 10.0.1.10 to any

The anchor's rule lets the echo request through, but the echo reply (source 10.0.2.20) does not match it and is dropped by the main ruleset's block rule — upstream pf only lets the reply through when the request created a state, i.e. with "keep state". The anchor rule now reads "pass in quick proto icmp from 10.0.1.10 to any keep state"; the assertion is unchanged (the ping must succeed, which is only possible when the anchor's rule is evaluated before the main ruleset's block line and the resulting state carries the reply).

5. tests/vm/04-anchors.sh + tests/vm/lib.sh + scripts/vm-run-tests.sh

• The gate now retries the ICMP echo a few times. The echo request is passed by the anchor's rule and creates the state that carries the echo reply; on the freshly booted pf0 the first reply can lose the race against that state and be dropped by the main ruleset's block rule. Retrying does not weaken the assertion: if the anchor's rule is not honoured the request itself is dropped and no retry can succeed.
• pfput() (tests/vm/lib.sh) and deploy() (scripts/vm-run-tests.sh) no longer swallow scp failures. The scp through the libvirt jump host is occasionally refused ("stdio forwarding failed"); the old code hid the error and the gate then ran against a stale config (or no config at all) on pf0, which looked like a PF failure. Both now retry and verify the copy, and vm-run-tests.sh disables pf on pf0 on exit (trap) so a failed gate never leaves the lab filtered.