My setup:

• NIC, Intel i350 with VLANs applied on the hypervisor (kvm)
• VLANs also applied on the VMs (802.1q)
• spoof check on
• one pfsense VM, 2.4.3 RELEASE (amd64) with severall VFs
• one ubuntu based VM with severall VFs
• ubuntu based host, with severall PFs
• all related PFs and VFs share the same VLAN

What works:

• pfsense to external PC
• ubuntu VM to external PC
• ubuntu VM to host, i.e. to PF

What doesn't work:

• pfsense to ubuntu VM
• pfsense to host, i.e. PF (in contrast to the ubuntu VM!)

What i tried so far:

• disabling HW offloads on pfsense VF (w/o an success)
• disabled spoof check to see whether packets are received e.g. w/o VLAN tag
• tcpdump on host shows that e.g. ARP REQs from pfsense (cmd line ping) are received
    but ARP replies being send are not received on the pfsense interface!

Sounds to me like a pfsense or freeBSD issue, since ubuntu works fine in that respect.

Any hint, comment or further questions are pretty much appreciated.

Thanks a lot,
Dieter