What can we improve?
Code clarity and correctness

/dev/pf ioctl interface
cleanup - extremely difficult to do without breaking something
documentation

feature removal
Make rdr/nat pools only work with tables
route-to and friends

More regression tests
API/ABI tests
End-to-end packet flow testing