bin/58884: npfctl validate seems to ignore "!" in the rules

[yamt9999%gmail.com@localhost]

>Number:         58884
>Category:       bin
>Synopsis:       npfctl validate seems to ignore "!" in the rules
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 09 05:55:00 +0000 2024
>Originator:     YAMAMOTO Takashi
>Release:        10.0
>Organization:
>Environment:
NetBSD tadpole 10.0 NetBSD 10.0 (GENERIC) #0: Thu Mar 28 08:33:33 UTC 2024  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm

>Description:
my expectation: "! $table" is an inverse of "$table"

actual: see below.

(i'm just learning the npf.conf syntax. my expectation might be wrong.
but IMO the current behavior is very confusing even if it isn't considered broken.)

tadpole% cat npf.conf 
$private = { 10.0.0.0/8 }
map lo0 dynamic any -> 192.168.1.1 pass from any to ! $private
map lo0 dynamic any -> 192.168.1.1 pass from any to $private
group default {
}
tadpole% npfctl validate npf.conf
map lo0 dynamic any -> 192.168.1.1 pass family inet4 to 10.0.0.0/8 
map lo0 dynamic any -> 192.168.1.1 pass family inet4 to 10.0.0.0/8 

group default { 
}

tadpole%

>How-To-Repeat:
see above.

>Fix: