pfctl_change
#define _OUT(_field) offsetof(struct pfctl_change, _field)
struct pfctl_change change = { 0 };