pf NAT and VNET Jails

I'm at r290228 on amd64. I'm not sure which revision I was on last when it
last worked, but it seems VNET jails aren't working anymore.

I've got a bridge, bridge1, with an IP of 192.168.7.1. The VNET jails set
their default route to 192.168.7.1. The host simply NATs outbound from
192.168.7.0/24 to the rest of the world. The various epairs get added to
bridge1 and assigned to each jail. Pretty simple setup. That worked until
today. When I do tcpdump on my public-facing NIC, I see that NAT isn't
applied. When I run `ping 8.8.8.8` from the jail, the jail's 192.168.7.0/24
address gets sent on the wire.

Let me know what I can do to help debug this further.

Thanks,

Shawn Webb