>> 	we currently do show them via "setkey -DP".
>no, we don't.
>spddump dumps policies on sptree (ie. only spd ones) while spdflush
>flushes ones on sptailq (ie. both of spd and pcb ones).

	which tree are you looking at?  this is on 2.0E and i see number of
	stuff like below.  and it is intentional.

itojun
 

# setkey -DP
(no selector, probably per-socket policy)
	out bypass                     
	created:                       lastused:
	lifetime: 0(s) validtime: 0(s)
	spid=16418 seq=0 pid=0
	refcnt=3