Clarify kldload pf is only needed for the dry-run check, not service start

Verified on the VM: service pf start auto-loads the kernel module itself
(required_modules="pf" in /etc/rc.d/pf, which rc.subr honors for start
specifically) - service pf check and bare pfctl don't get the same
treatment, so kldload is only necessary if you want to dry-run the
ruleset before committing to it. The previous wording implied it was
needed either way.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/README.md b/README.md
index 4244ab8..befa2e3 100644
--- a/README.md
+++ b/README.md
@@ -177,12 +177,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the
 wrong one and NAT jail traffic to the *private* address instead, which is
 just as unreachable from the internet as no NAT at all.
 
-Check syntax before loading - `pfctl -nf` needs the kernel module loaded
-even for a dry run - then enable it the normal way:
+`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d
+script loads the kernel module itself, no manual `kldload` needed. Only
+reach for `kldload pf` if you want to dry-run check the syntax with
+`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d
+script) doesn't load the module for you, dry run or not:
 
 ```
 # kldload pf
 # pfctl -nf /etc/pf.conf
+```
+
+```
 # sysrc pf_enable="YES"
 # service pf start
 ```