🚀 go-pugleaf

I want a nit filter that gives me all non-ip packets and certain ip
packets.  As I read the manual [nit_pf(4m)], this code should give me all
the non-ip packets:

    *fwp++ = ENF_PUSHWORD + shorts(offsetof(struct ether_header, ether_type));
    *fwp++ = ENF_PUSHLIT | ENF_CNAND;
    *fwp++ = ETHERTYPE_IP;

    ... tests for the ip packets I want ...

but it appears to reject the non-ip packets instead.  If I replace it with
this (which should be equivalent) it works:

    *fwp++ = ENF_PUSHWORD + shorts(offsetof(struct ether_header, ether_type));
    *fwp++ = ENF_PUSHLIT | ENF_EQ;
    *fwp++ = ETHERTYPE_IP;
    *fwp++ = ENF_PUSHZERO | ENF_COR;

    ... tests for the ip packets I want ...

In the first case, CNAND shoud return true if ether_type and ETHERTYPE_IP
are not equal.

In the second case, COR should return true if
(ether_type == ETHERTYPE_IP) and zero are equal.

Is there a bug in the manual, the implementation, or my understanding?

[The macros shorts and offsetof are defined like this:

  #define offsetof(type, field) ((int)&((type *)0)->field)
  #define shorts(n) ((u_short)((n) / sizeof(u_short)))
]

-- Richard