My problem is with netkey/key.c (compiled only for IPSEC):

	struct secasvar *
	key_allocsa(family, src, dst, proto, spi, sport, dport) 
  	      u_int family, proto;
   	     caddr_t src, dst; 
   	     u_int32_t spi;
   	     u_int16_t sport, dport;
	{ 

where sport and dport are unused.  Well, almost -- they're unused if you
just define IPSEC, but they are used if you also have IPSEC_NAT_T.  I'm
not sure what to do -- having an #ifdef in the function prototype seems
rather wrong...  (This is yet another example of why I really don't like
#ifdef.)