'everything was upside down'
We inherited last matching rule wins from IPfilter, and note
block pass from 192.168.103/24
and
pass from 192.168.103/24 block
are *not* equivalent
$ sudo pfctl -vnf samples/example001
$ sudo pfctl -vnf samples/example002