I'd like to see uplift of the network stack. In particular, IPSEC availability by default (seriously, I don't want to compile a custom kernel to set up a VPN), and an updated PF from upstream.