pf: return PF_PASS/PF_DROP from pf_setup_pdesc()

We returned 'PF_DROP' instead of '-1' in one case, which would lead to us
continuing the processing for an invalid packet.
This also aligns us closer to OpenBSD, and reduces the odds of future similar
mixups.

MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")