I don't understand why everyone is picking on algif_aead for copy.fail. It's authencesn that's actually fucking things up. Sure, you could keep using authencesn for IPsec if you break AF_ALG AEADs. But why? I'd rather break ESN support in IPsec and keep AF_ALG working for AEADs. It doesn't even break IPsec, it just makes it rotate keys more often in very high bandwidth situations.