Improved logic for finding/fixing Apple typo in pf rules