The crypto(9) framework used by IPsec runs on a kernel task that

The crypto(9) framework used by IPsec runs on a kernel task that
is protected by kernel lock.  There were crashes in swcr_authenc()
when it was accessing swcr_sessions.  As a quick fix, protect all
calls from network stack to crypto with kernel lock.  This also
covers the rekeying case that is called from pfkey via tdb_init().
OK mvs@