In each case I have port forwarding to a PBX with SIP trunks (5060 and 10000-20000). After upgrading, the port forward no longer works. Inbound calls still hit the PBX, but get two-way silence, a classic symptom of NAT issues. Outbound calls from the PBX still work, so things are not completely broken.

If I remove the port forward and add a 1:1 NAT to the PBX, SIP calls work. However, this is not an option, because I am also running OpenVPN.

I am able to replicate the issue on several different units, so it's not just a once-off glitch. I've tried deleting the rules and adding them back after upgrading. Tried increasing state timeouts as someone suggested. Someone else suggested this patch https://redmine.pfsense.org/issues/12834 but it did not help.