untrusted comment: signature from openbsd 6.1 base secret key
RWQEQa33SgQSEkpq7n8ALOeGORiKmP4CJFUl/4Pu3VbherjEnZGJ0vvKM+93JrlaIUDViKiFwXMREDH7zxD7Om37hVodlukI2gM=

OpenBSD 6.1 errata 038, March 20, 2018:

The IPsec AH header could be longer than the network packet.
This may cause a kernel crash.

Apply by doing:
   signify -Vep /etc/signify/openbsd-61-base.pub -x 038_ahauth.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/netinet/ip_ah.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_ah.c,v
retrieving revision 1.129.4.1
diff -u -p -r1.129.4.1 ip_ah.c
--- sys/netinet/ip_ah.c 1 Feb 2018 22:07:24 -0000       1.129.4.1
+++ sys/netinet/ip_ah.c 14 Mar 2018 23:23:26 -0000
@@ -583,7 +583,16 @@ ah_input(struct mbuf *m, struct tdb *tdb
                   "in SA %s/%08x\n", hl * sizeof(u_int32_t),
                   ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
                   ntohl(tdb->tdb_spi)));
-
+               ahstat.ahs_badauthl++;
+               m_freem(m);
+               return EACCES;
+       }
+       if (skip + ahx->authsize + rplen > m->m_pkthdr.len) {
+               DPRINTF(("%s: bad mbuf length %d (expecting %d) "
+                   "for packet in SA %s/%08x\n", __func__,
+                   m->m_pkthdr.len, skip + ahx->authsize + rplen,
+                   ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+                   ntohl(tdb->tdb_spi)));
               ahstat.ahs_badauthl++;
               m_freem(m);
               return EACCES;