os-telegraf: PF input fails when Telegraf runs as telegraf user on OPNsense 26.7.1 (works immediately as root)

Environment
• OPNsense CE 26.7.1
• FreeBSD 15.1
• os-telegraf 1.12.15
• Telegraf 1.39.1
Description
After upgrading to OPNsense 26.7.1, PF metrics stopped updating.
Affected metrics include:
• PF Searches/s
• New PF States/s
• Closed PF States/s
pf.entries continues to work intermittently, but searches and related counters stop updating because the PF input plugin cannot read the expected output from pfctl.
Investigation
Running PF directly as root:
/sbin/pfctl -si
returns:
Status: Enabled
...
searches ...
Running Telegraf as root:
/usr/local/bin/telegraf
--input-filter pf
--test
--config /usr/local/etc/telegraf.conf
produces valid metrics:
pf,...
entries=442i
searches=4189467i
...
However, running exactly the same commands as the telegraf user:
su -m telegraf -c "/sbin/pfctl -si"
returns:
Status: Disabled
and
su -m telegraf -c "/usr/local/bin/telegraf --input-filter pf --test --config /usr/local/etc/telegraf.conf"
returns:
E! [inputs.pf] Error in plugin:
struct data for tag "searches" not found in pfctl output
Permissions checked
telegraf is a member of the proxy group:
uid=884(telegraf)
gid=884(telegraf)
groups=884(telegraf),59(unbound),62(proxy)
/dev/pf permissions:
crw-rw---- root proxy
ACL:
user::rw-
group::rw-
other::---
No securelevel restrictions:
kern.securelevel = -1
Workaround
Changing the Telegraf service to run as root:
telegraf_user=root
telegraf_group=wheel
makes all PF metrics immediately start working again after restarting Telegraf.
Expected behavior
The telegraf user (member of the proxy group) should be able to collect PF statistics as in previous OPNsense releases.
Actual behavior
When running as the telegraf user:
• pfctl -si reports Status: Disabled
• PF statistics are incomplete
• Telegraf PF input fails because expected fields such as searches are missing.
When running as root, everything works correctly.

This appears to be either:
• a regression in OPNsense 26.7.1,
• or a FreeBSD 15.1 PF permission/regression affecting non-root users.

Reproduce the issue with /sbin/pfctl -si and the Telegraf command using both root and the telegraf user, then compare the PF output and /dev/pf permissions. The change is complete when the telegraf user can collect searches, state counters, and other PF metrics without running the service as root.