Is the firewall really pfctl, or another instance of pfctl?
There's no second instance of pfctl running.  Pretty much everything you have to do with pfctl requires root priviliges.

For example, just getting a listing of rules without using sudo gives a "permission denied"

$ pfctl -sr
pfctl: /dev/pf: Permission denied


Adding sudo allows you to view the current rule set:

$ sudo pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all


The issue you may be experiencing might be related to this post:  Application Firewall is not enabling pfctl