libifconfig and libpfctl look fine to me.

In D52234#1193199, @guest-svmhdvn wrote:

Instead of skipping these and keeping around lots of code to check the ovpn version, why not just temporarily xfail them like I've done in the attached patch of https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289150? That way, once Ports contains ovpn>=2.7, these tests will automatically start failing again with the message "failed: expected failure, but none found". We can remove the xfails promptly afterwards.

Also not something that must be done in this commit, but we should modify sbin/ifconfig to the new functions. That'll remove a little more code from ifconfig and it'll mean we test this code (as part of any test that runs ifconfig foo up).

The commit message needs to answer the "Why?".
Why are we bypassing the reference counting?

Looks good, other than these minor remarks.

A quick pfctl test case for the parser changes (i.e. just a simple prefer-ipv6-nexthop route-to line) would be nice to have too.