diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 4fa3af6a414c..a41a6df63f51 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec.c,v 1.45 2009/06/25 17:39:51 christos Exp $	*/
+/*	$NetBSD: ipsec.c,v 1.46 2009/07/30 14:41:59 jakllsch Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $	*/
 /*	$KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $	*/
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.45 2009/06/25 17:39:51 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.46 2009/07/30 14:41:59 jakllsch Exp $");
 
 /*
  * IPsec controller part.
@@ -2203,8 +2203,10 @@ ipsec6_check_policy(struct mbuf * m, const struct socket * so,
 	if (!ipsec_outdone(m)) {
 		s = splsoftnet();
 		if (in6p != NULL &&
-				IPSEC_PCB_SKIP_IPSEC(in6p->in6p_sp, IPSEC_DIR_OUTBOUND))
+		    IPSEC_PCB_SKIP_IPSEC(in6p->in6p_sp, IPSEC_DIR_OUTBOUND)) {
+			splx(s);
 			goto skippolicycheck;
+		}
 		sp = ipsec6_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, &error,in6p);
 
 		/*