sys/netipsec/ipsec_output.c line 483: setdf = ntohs(ip->ip_off & IP_DF); Should be: setdf = ntohs(ip->ip_off) & IP_DF;
The problem was fixed in 11.x+ releases. But 10.x has reached EOL.
Correct resolution (FIXED: resolved by a change: commit) Fixed in base r297014 (head at the time, became stable/11)