During evaluation of the ruleset by pf_test_rule() all "match" rules are
gathered in match_rules to be later copied into a state once a "pass"
rule finally accepts the packet.
When pf_create_state() fails due to hitting limits it terminates early
without calling pf_free_state(), as the state has not been allocated
yet. In such case free match_rules as the caller pf_test_rule() won't do
it.