pf: reduce the risk of src/dst mis-use

NULL out src/dst and check them rather than relying of 'af' to indicate
these variables are valid.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D35573