In npf, I think one can write bpf expressions but I'm not sure the full ethernet packet is available, vs only the IP address. There is some ability to use ipfilter within bridge(4), but I'm not clear on if one can do that with npf, or if one can filter on mac address.
Attachment:
signature.asc
Description: PGP signature