npf_session_inspect: do not silently drop the packet on state check failure.
Let the rules deal with it (e.g. we may want to log it).
npftest: fix the example in the README file.
Lazy VFP processing works a lot better if the functions contain a return
instruction.
NPF: imply SYN-only check for the stateful rules by default (when inspecting
TCP packets).  Many users trip here.  This behaviour can be overriden with the
explicit "flags" keyword, but other configuration does not really make sense.
Use onoff() macro.
sigexit() calls either exit1() or panic() and never returns.  Mark it as
__dead.
 Usually schednetisr() is called after enqueueing a packet with IF_ENQUEUE().
In some functions, they do it in reverse order. It's not a bug because
the pair is protected with splnet()/splx(s). It's not good for readability
and someone might mistake when modifing a code. Yes, I'm one of the person :-(

 Save a NETISR_* value in a variable and call schednetisr() after enqueue
a packet for readability and future modification.
 Put schednetisr(NETISR_IP) into splnet()/splx() pair.
This avoid extra ipintr() call with empty queue.
 Put schednetisr(NETISR_IP) into splnet()/splx() pair.
 Put schednetisr() into splnet()/splx() pair.
This might avoids delay of processing a packet.
 Save a NETISR_* value in a variable and call schednetisr() after enqueue
a packet for readability and future modification.
Fix setcontext signature, which has a single argument not three.
Regen for setcontext signature.