> You may want a file a PR so this is not forgotten.
>
> One fix is to start pf later after mountcritremote and don't do BEFORE:
> NETWORKING. But loses the value of pf_boot since it won't be enabled
> before networking.
>
> (I attempted some reordering to use beforemountlkm but caused
> rcorder recursive issue with syslogd.)

I think pf_boot is a bit redundant, personally.  Couldn't those rules
just be added to the default pf.conf?

To use pf_boot in this situation, couldn't it be used to #PROVIDE:
pf_depend_boot and then rc.d/pf could, obviously, #REQUIRE:
pf_depend_boot?  Although I'm still not really sure why pf_boot was
loading at the correct time and pf wasn't.