It looks like we only use this in a loop that ends when mask == 0x40, so we're never going to see ECE, CWR or AE there, right?

I found TCPF_ALL is used in printtcpflags() from sbin/ipf/libipf/printtcpflags.c.

Would you please also add these in flagset[] and flags[] from sbin/ipf/libipf/flags.c?

Then let's remove the magic number, and decode all TCP header flags properly for logging instead...

Looks the same typo is among these lines, shall use __tcp_get_flags() inside, like this:

	__tcp_set_flags(tcp, __tcp_get_flags(tcp) | TH_SYN);

I am thinking if we can just use the super set macro TH_FLAGS from sys/netinet/tcp.h or TCPF_ALL from sys/netpfil/ipfilter/netinet/ip_compat.h. But looks there is duplicated definition as TH_ECE == TH_ECN. I am confused about which one to use. But since you are using TH_ECE, so I take it for granted to use TH_FLAGS from sys/netinet/tcp.h.

Shall be W for TH_CWR.

Yes, there is no point of having multiple independent definitions to sum up all the TCP header flags. Removing the redundant definitions and using TH_FLAGS is the better path. Thanks!