Some preliminary stuff:

#1 now that you are working on your own htaccess, you can throw out the <ifmodule> lines. You either have mod_rewrite or you don't. You can also throw out the RewriteBase line because / is the default. Keep the "RewriteEngine On" but make sure it occurs only once, before all rewrites.

#2 Similarly, throw out the !-f and !-d lines. They have their uses in individual rules, but otherwise they put the server to a colossal amount of work by making it stop and evaluate every single request. It's better to make custom 403 and 404 pages and let those pages include a link to the Index page.

#3 leave a blank line after each RewriteRule. This is for your own sanity, not for syntax. Especially note that Conditions only apply to the immediately following Rule. Keep the # annotations. This is a very good habit.

#4 Put [L] at the end of each Rule unless there is a clear and specific reason not to.

#5 Get a firm grip on the difference between a Rewrite and a Redirect. Both can be done using mod_rewrite, but the wording is slightly different and the real-life effect is very different.

Now then...

example.com/category/blahblah

is not a subdomain, it is a directory. A subdomain would be

category.example.com/blahblah

That's assuming you are talking about what the user sees in their browser's address bar. Where the files are physically located is a completely different issue.

Thanks for the advices :)

In this specific case I want to rewrite the subdomain blablah.example.com to the directory example.com/category/blahblah (the "category" keyword is constant)

When it will work I'll look into optimizing adding the part about the media files to speed up the -f and -d RCs.

After several modifications, the best, but still not functional, I could come to is this:

RewriteEngine on

# WP standard
RewriteRule ^index\.php$ - [L]

# if requested subdomain is not base domain
RewriteCond %{HTTP_HOST} !^example\.com$

# and we have not already rewritten this request to the subdomain's subfolder
RewriteCond %{REQUEST_URI} !^/category/.*

# extract requested subdomain to %1
RewriteCond %{HTTP_HOST} ^([^\.]+)\.example\.com$

# rewrite the request to the subdomain's subfolder and than index.php
RewriteRule (.*) /category/%1/$1 [C]
RewriteRule . /index.php [L]

# WP standard
RewriteCond %{REQUEST_FILENAME} !-f

# WP standard
RewriteCond %{REQUEST_FILENAME} !-d

# WP standard
RewriteRule . /index.php [L]

From the error log it seems it's going pretty well, until near the ends, the INTERNAL REDIRECT occurs, and the /category/test/ part goes missing and in fact the browser shows me the blog index, not the /test/ category listing (no more infinite redirect loop at least):

strip per-dir prefix: D:/Sites/example/ -> 
applying pattern '^index\.php$' to uri ''
strip per-dir prefix: D:/Sites/example/ -> 
applying pattern '(.*)' to uri ''
RewriteCond: input='test.example.com' pattern='!^example\.com$' => matched
RewriteCond: input='/' pattern='!^/category/.*' => matched
RewriteCond: input='test.example.com' pattern='^([^\.]+)\.example\.com$' => matched
rewrite '' -> '/category/test/'
applying pattern '.' to uri '/category/test/'
rewrite '/category/test/' -> '/index.php'
internal redirect with /index.php [INTERNAL REDIRECT]
[redir#1] (3) strip per-dir prefix: D:/Sites/example/index.php -> index.php
[redir#1] (3) applying pattern '^index\.php$' to uri 'index.php'
[redir#1] (1) pass through D:/Sites/example/index.php

So at this point I should tell the rewrite process to stop just before the INTERNAL REDIRECT or at least not to lose the /category/test/ part at the next steps.

Still it wouldn't be that good because of the lack of !-f and !-d in the first block, but one issue at a time.

# rewrite the request to the subdomain's subfolder and than index.php
RewriteRule (.*) /category/%1/$1 [C]
RewriteRule . /index.php [L]

See what we mean about spacing and conditions? Those are two entirely separate rules, and the second one has no conditions. The [C] flag doesn't mean that the previous set of conditions continues to apply; it simply means "don't stop". But you do want to stop, because that final rule was only meant to kick in as a response to requests for nonexistent files or directories. If you absolutely must keep it, you need to apply the conditions all over again.

If the request is for a directory, like "category", that does exist, you don't want to lump it in with all the other generic rewrites. Matter of fact, rewriting any and all nonexistent files to index.php seems like just asking for trouble.

Yes it was late when I tried it and eventually I went crazy and made mistakes and mistakes :(

By the way "category" is not a real filesystem directory, is a symbolic url treated by Wordpress to select articles based on the article's category, whose slug comes after. ( /category/slug/ is something similar to the old fashion GET style index.php?category=test )

About the two rules, I tried the variant:

# rewrite the request to the subdomain's subfolder and than index.php
RewriteRule (.*) /category/%1/$1 [PT]

Still with no success. I thought it would have restarted the the process from the beginning with the well rewritten url /category/test/ , instead the blog shows the index, eg with no category filtering.

Just for "fun", I tested with the R=301 flag and it works in the sens that it does redirect correctly to:

# rewrite the request to the subdomain's subfolder
RewriteRule (.*) /category/%1/$1 [R=301,L]

>>> http ://test.example.com/category/test/

Apart that, I don't want this way because it's ugly as hell since it keeps the "test." subdomain part among the fact it shows /category/test/ after.

So I still seek the pass through solution.

Why can't the request for the subfolder and the request for that subfolder's index.php be part of the same Rule?

There is no index.php in the subfolder(s) because as I said in the previous reply, those are not real folders in the filesystem, they are symbolic URLs only. Maybe I left a misleading comment above a rule but it was a remain from a copy/paste.

The index.php is only one and is in the root at /

This is the way Wordpress and most CMS works, using an index.php as main app gateway.

An internal rewrite connects an external URL request to an internal file that will serve the content. Set up a RewriteRule with a RegEx pattern that will match the correct URL requests. Set the rule target to be the internal path and filename that will serve the content. Add the [L] flag.

Thanks for the information, but it seems I've reached my limit on what I can do through .htaccess, I'll try doing that via PHP :(

Ok, so I just discovered that it's IMPOSSIBLE to reach the topic objective by only editing the .htaccess file, because at certain points Wordpress does some redirections and the url displayed in the address bar of the browser will not reflect the preferred subdomain version.

At first I was able to avoid an .htaccess redirection that was causing me much trouble in the previous replies, by digging into the Wordpress source files and putting this into .htaccess (for the basic category articles listing):

RewriteCond %{HTTP_HOST} !^www\.
RewriteCond %{HTTP_HOST} ^(.+)\.example\.com$
RewriteRule ^$ /index.php?category_name=%1 [L]

In this way the address bar manteined the cat.example.com form, but when the Wordpress articles paging was activated, that is when the number of articles in the category exceed the "articles per page" limit, Wordress does an external redirection and the url in the address bar turn into the www.example.com/category/cat/ vanishing all the .htaccess efforts.

There are also other fuctions that print the non-subdomain version eg links to other page numbers for paging in the HTML also, and all this functions need proper filtering through some sort of plugin that now I'm trying to write.