pflogd contained the same "privsep error" as tcpdump -- assuming that

pflogd contained the same "privsep error" as tcpdump -- assuming that
it can ioctl()'s against a bpf device node.  Privsep that operation
via a message to the parent process.  Unfortunately "rpath wpath cpath"
is still needed due to SIGHUP handling, but I have asked canacar the
expert to look into this.