Reading your analysis of fast-ipsec and tags..

The code reuses the mbuf here rather than allocating a new one.  If you
did use a new one, it wouldn't have the tags, so in my opinion, the code
needs to make the reused one look like a new one as that's the general
case for most data that gets sent "out" over a NIC.

Maybe flushing the tags is just a symptom of something that should be a
call like m_reusembuf() that also clears checksum related flags or anything
else that might be appropriate that has been set on the way there.

Note, I think this is separate to what the status of any tags is going to
be at any particular point in time throughout the network code or along
any particular code path.

Darren