> through the [?] for each

BSD pf is interpreted by a kernel module in kernel mode. There is no e.g. kernel / user transition involved.