Tagged packets partially broken after upgrade to 12.4

From: kaycee gb <kisscoolandthegangbang_at_hotmail.fr>
Date: Thu, 18 Jan 2024 12:10:32 UTC
Hi,

I have a host which is running 12.3p12 amd64 I want to make it up to date.
There are different services provided by different jails in combination with
different fibs and different loopback clones. All is running well with 12.3p12.

As a first step in the upgrade process I updated to 12.4p9. After restart, I
had different services that were not working correctly. 

Done some troubleshooting and discovered that some pf rules wich depend on
tagged packets were not working anymore. 

For example, I have to add a second rule because tagged is not considered here:
> rdr on jsw2 proto tcp   tagged DNSC     -> 10.1.2.3 port 1234
> # 12.3 -> 12.4
> rdr on jsw2 proto tcp   from 10.1.1.1 to 1.2.3.4      port 53 tag DNSC ->
>  10.1.2.3 port 1234

The "tagged DNSC" refers to previous rules were I apply a tag. There are other
rules after that, which depend on "tagged DNSC" packets, who start working once
retagged as DNSC with the second rule. 

Another example:
> pass    in      quick on lo0    tagged TOSYSLOG
> pass    in      quick on lo0    proto udp       to 10.91.0.254 port 514 tag
> TOSYSLOG

I had to add the second rule too as a quickfix. 

Searching via bugtracking, mailing lists, UPDATING file and forum, I have not
come to anything that could explain this, and I would not expect, this thing
to break here in the upgrade process. 

So, maybe someone have an idea what is happening and where to look for a
solution ? 
This is a host with few services, where I discover communication
breaks between services one after the other. I have also another host with
more services i will have to upgrade also. 

Thanks in advance,
K.