pf: handle divert packets

In a divert setup pf_test_state() may return PF_PASS, but not set the state
pointer. We didn't handle that, and as a result crashed immediately afterwards
trying to dereference that NULL state pointer.

Add a test case to provoke the problem.

PR: 260867
MFC after: 2 weeks
Submitted by: Phil Budne <phil.budne@gmail.com>
Sponsored by: Rubicon Communications, LLC ("Netgate")