commit 61d236ad6cb89bc3edd77507018c65156cafd421
Author: Kristof Provost <kristof@codepro.be>
Date:   Fri Jun 10 16:29:32 2016 +0200

    pf: Map hook returns onto the correct error values
    
    pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
    expect to get E<foo> error codes.
    Map the returns values. A pass is 0 (everything is OK), anything else means
    pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
    error message.
    
    PR:	207598

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 3291c9b..534bfad 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -3562,7 +3562,9 @@ pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3577,7 +3579,9 @@ pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif
 
@@ -3600,7 +3604,9 @@ pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3616,7 +3622,9 @@ pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif /* INET6 */