ip6_tryforward() sends time exceeded for an expiring packet before the
inbound pfil hooks have seen it, whereas ip_tryforward() and
ip6_forward(), which ip6_input() calls after the hooks, check it
afterwards. On the fast path the router therefore answers packets the
firewall blocks inbound, and pf never handles the expiry itself: a
nat64 (af-to) packet with hop limit 1 gets a time exceeded error from
the router, which a "block" ruleset then drops on the way out, instead
of the one pf_translate_af() sends with the untranslated addresses.
Check the hop limit after the inbound hooks.
Fixes: 5a1842a2 ("Add ip6_tryforward() - a run to completion ...")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")