gpart backup ada0 | gpart restore -F ada3, BIOS bootcode on the freebsd-boot partition, loader.efi on the ESP, and zpool replace zroot ada3p4. Never the whole disk: you would lose the boot partitions.
pfctl -sT lists tables; pfctl -t -T show|add|delete|test|flush|replace -f. On pfSense aliases are tables, sshguard is the failed-login lockout, and manual changes vanish on the next rules reload.
pkg-static does not depend on libssl and keeps working. certctl rehash, pkg-static install -fy pkg, pkg-static install -xfy pfSense-repo pfSense-upgrade, then the upgrade through System > Update, never with pkg upgrade.