Even more tentacles
Sticking more in the state

Now that relevant PF states are directly to the packet, we can use the state to cache other things:
TCP/UDP PCBs (for locally terminated connections)
route lookups
IPsec SAs
Other tunnel/connection contexts (npppd?)