Apply by doing:
	cd /usr/src
	patch -p0 < 016_getsockopt.patch

Then build and install a new kernel.

Index: sys/netinet/ip_output.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_output.c,v
retrieving revision 1.191
diff -u -p -r1.191 ip_output.c
--- sys/netinet/ip_output.c	9 May 2008 02:56:36 -0000	1.191
+++ sys/netinet/ip_output.c	28 Oct 2009 19:57:05 -0000
@@ -1485,6 +1485,7 @@ ip_ctloutput(op, so, level, optname, mp)
 		case IP_ESP_TRANS_LEVEL:
 		case IP_ESP_NETWORK_LEVEL:
 		case IP_IPCOMP_LEVEL:
+			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 #ifndef IPSEC
 			m->m_len = sizeof(int);
 			*mtod(m, int *) = IPSEC_LEVEL_NONE;
Index: sys/netinet6/ip6_output.c
===================================================================
RCS file: /cvs/src/sys/netinet6/ip6_output.c,v
retrieving revision 1.103
diff -u -p -r1.103 ip6_output.c
--- sys/netinet6/ip6_output.c	30 Jul 2008 15:07:40 -0000	1.103
+++ sys/netinet6/ip6_output.c	28 Oct 2009 21:06:57 -0000
@@ -1882,6 +1882,7 @@ do { \
 			case IPV6_ESP_TRANS_LEVEL:
 			case IPV6_ESP_NETWORK_LEVEL:
 			case IPV6_IPCOMP_LEVEL:
+				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 #ifndef IPSEC
 				m->m_len = sizeof(int);
 				*mtod(m, int *) = IPSEC_LEVEL_NONE;