> Here is one proposal to address various concerns about deletion of
> tags in if_loop: we introduce the idea of `persistent' packet tags.
> The API definess persistent tags as staying with an mbuf until the
> mbuf is freed. (I will handwave away issues with copying versus moving
> packet-tag,s for now).
> 
> We introduce a new function, m_tag_delete_nonpsersistent(), as below.
> It will then be correct to call m_tag_delete_nonpersistent() when
> reflecting ICMP packets, or from within if_loop. Yet the API still
> meets the needs of other *BSD users of the packet-tag API who need
> persistence for their tags.
> 
> Comments?

	i don't think such complexity is not needed.  you just need to cleanup
	fast-ipsec m_aux on the call to if_output, that's all you need to do.

itojun