OK, it looks like passing the NULL from tcp to ip_output()
(where you pointed out) from some time back is the real lossage.
Passing the NULL there masked it.

OTOH, the reason for the commit was to expunge ipsec_setsocket() and
ipsec_getsocket() entirely. Please go ahead and pass the struct
socket* --unless you'd like me to uncomment the getsocket() and fix it
myself? Seems like its my duty, unless you'd rather do it.