Looks like a regression introduced by: Add ipv6 support for fast_ipsec - IPv4 also suffers the problem; it's just that my packet test packet wasn't big enough to be compressed (IPv6 lacks that) - the return packet gets dropped by NetBSD ....