Starting from FreeBSD 10 the GENERIC kernel configuration on both i386 and amd64 contains full Xen PVHVM support, so there's no need to compile a specific kernel in order to get Xen drivers. Previous versions of FreeBSD (8.x and 9.x) required the user to compile a custom (XENHVM) kernel in order to make use of the PV optimizations when running inside of a HVM container.
What do you expect if PV is enabled at hypervisor and em0 was an fall back and suddenly PV is available in a new kernel?
It's like with all other drivers. If there is a new driver in a new kernel which fits better it will be loaded first.
But as I said: I really want the new xn0 because it needs less CPU time. But tagging must be possible. Please report it upstream.
If you patch the config.xml tagging was possibe for ICMP and UDP.
The next step after migrating to debian jessie (Xen 4.4) is to test PVH (without QEMU): https://wiki.freebsd.org/FreeBSD/XenNG
But I guess pygrub has to learn more about UFS to grab the kernel from the image.
Is it possible to boot pfsense disk less from nfs?