Fix DF-3268 (enforce PF_LIMIT_STATES on the state creation path)

--- a/sys/net/pf/pf.c
+++ b/sys/net/pf/pf.c
@@ -4110,6 +4110,13 @@ pf_create_state(...)
 	int cpu = mycpu->gd_cpuid;
 
 	/* check maximums */
+	if (pf_status.states >=
+	    pf_pool_limits[PF_LIMIT_STATES].limit) {
+		PF_INC_LCOUNTER(LCNT_STATES);
+		REASON_SET(&reason, PFRES_MAXSTATES);
+		return (PF_DROP);
+	}
+
 	if (r->max_states && (r->states_cur >= r->max_states)) {
 		PF_INC_LCOUNTER(LCNT_STATES);
 		REASON_SET(&reason, PFRES_MAXSTATES);
 		return (PF_DROP);
 	}