Introduced to NetBSD 2.0 as the package security/pflkm, in the base system from NetBSD 3.0 onwards (PF in NetBSD 5.1 si ~ OpenBSD 3.7)
Your kernel configuration file needs these non-default options:
pseudo-device pf # PF packet filter pseudo-device pflog # PF log interface
Add to /etc/rc.conf:
pf=YES pflogd=YES
in /etc/lkm.conf:
/usr/lkm/pf.o - - - - BEFORENET