2) This software is only of use to a small subset of people, namely
   those who do or would use NetBSD for routing.

currently.  i would use it on *ALL* my hosts if it was there.  being
able to say "block all traffic to port 2049" on any specific host is
a feature.
   
   4) What I said amounted to `This is the way I would like it done.',
   *not* `This is the One True Way (tm) of doing it, and none other is
   acceptable.'

the latter is how it came across to me.  you also meantioned bpf (i
think), and the fact that it already does "packet filtering" .. but
is unable to block packets.
   
   If you'd like it put in, then I suggest you do the ground work to show
   that it *should* be put in (at all, and rather than some other
   package); that would be a much better use of time than flaming at us.

which will never get done and we'll never have it in our kernel.