from ICMP could end up in leaking the reference in iproute, as ipsec4_output would overwrite the ro pointer in state. Tested by Juraj Hercek and supposed to fix PR kern/35273 and kern/35318.