I have a fairly uncomplicated pf.conf (which I'm willing to share if asked). When my OpenBSD 3.8 (but this also showed up on 3.7) box reboots, it ends up staying in "safe" mode (ssh enabled, no pings enabled), as set up in the /etc/rc file.
Since pings aren't enabled, I'm required to repeatedly try to ssh in, and when that works, I issue "pfctl -v -f /etc/pf.conf", and it loads just fine! What's different between the time that pfctl is called right after /etc/netstart (which apparently is failing to load the rules), and pfctl is called by me when I've finally logged in? And unfortunately, this is a remote box, so I can't watch the console. :( Any ideas?