bpf(4) bypassing pfil(9)?

[Timo Buhrmester <fstd.lkml%gmail.com@localhost>]

Using a bpf network tap (like dhcpd does), packets injected or received on it effectively bypass pfil(9).  I noticed it by using npf to block DHCP traffic from a particular network, only to find out that hosts on that network are still able to get DHCP leases.

pfil(9) sees the inbound packets and they're correctly discarded by npf, but it seems the bpf interface receives a copy anyway.   Outbound packets are never passed through pfil at all.

Is this the way things are supposed to be?  I feel that packets received/injected no a bpf interface should still be subject to packet filtering.

Any insights?