Hi,

I assume by ipf in the document:

http://www.netbsd.org/Documentation/network/ipsec/#ipf-interaction

you mean ipf + ipnat?
So in the current situation, when using a box to do nat and ipsec(tunnel mode)
on
will cause problems because ipf will process the encapsulated and 
unencapsulated packages so causing that in tunnel mode a package is processed
two times by ipf/ipnat ? :)

So when just applying transport mode (with only esp)
in the release branche shouldnt be a 
problem, even not with nat?
Bye,

Mipam.