OS-2339 "bad pkt state alloc" kstats due to echo replies
OS-2595 net hooks registered with HH_BEFORE or HH_AFTER hints create invalid hint_value kstats
Reviewed by: Robert Mustacchi <rm@joyent.com>
OS-2544 ipf rules from the GZ should be add to in-zone rules, not replace them