untrusted comment: signature from openbsd 6.3 base secret key
RWRxzbLwAd76ZblnuQJzfDJ4izFnLuOIdtNCFSdJ+o8oKyZm1zFKd9Q7r0Hh2BzybMCgm190xFg+pBs2vfzcgFBVa3Ssg1XGvQE=

OpenBSD 6.3 errata 004, April 21, 2018:

In the gif(4) interface, use the specified protocol for IPv6, plug
an mbuf leak and avoid a use after free.

Apply by doing:
    signify -Vep /etc/signify/openbsd-63-base.pub -x 004_gif.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/net/if_gif.c
===================================================================
RCS file: /cvs/src/sys/net/if_gif.c,v
retrieving revision 1.113
diff -u -p -r1.113 if_gif.c
--- sys/net/if_gif.c	15 Mar 2018 21:01:18 -0000	1.113
+++ sys/net/if_gif.c	18 Apr 2018 20:21:24 -0000
@@ -338,7 +338,7 @@ gif_send(struct gif_softc *sc, struct mb
 		ip6->ip6_flow = htonl(flow);
 		ip6->ip6_vfc |= IPV6_VERSION;
 		ip6->ip6_plen = htons(len);
-		ip6->ip6_nxt = IPPROTO_GRE;
+		ip6->ip6_nxt = proto;
 		ip6->ip6_hlim = ttl;
 		ip6->ip6_src = sc->sc_tunnel.t_src6;
 		ip6->ip6_dst = sc->sc_tunnel.t_dst6;
@@ -403,6 +403,8 @@ gif_output(struct ifnet *ifp, struct mbu
 		error = ENOBUFS;
 		goto drop;
 	}
+	memcpy((caddr_t)(mtag + 1), &ifp->if_index, sizeof(ifp->if_index));
+	m_tag_prepend(m, mtag);
 
 	m->m_pkthdr.ph_family = dst->sa_family;
 
@@ -758,7 +760,7 @@ gif_input(struct gif_tunnel *key, struct
 	case IPPROTO_IPV4: {
 		struct ip *ip;
 
-		m = m_pullup(m, sizeof(*ip));
+		m = *mp = m_pullup(m, sizeof(*ip));
 		if (m == NULL)
 			return (IPPROTO_DONE);
 
@@ -779,7 +781,7 @@ gif_input(struct gif_tunnel *key, struct
 	case IPPROTO_IPV6: {
 		struct ip6_hdr *ip6;
 
-		m = m_pullup(m, sizeof(*ip6));
+		m = *mp = m_pullup(m, sizeof(*ip6));
 		if (m == NULL)
 			return (IPPROTO_DONE);
 
@@ -812,7 +814,7 @@ gif_input(struct gif_tunnel *key, struct
 	m_adj(m, *offp);
 
 	if (sc->sc_ttl == -1) {
-		m = m_pullup(m, ttloff + 1);
+		m = *mp = m_pullup(m, ttloff + 1);
 		if (m == NULL)
 			return (IPPROTO_DONE);
 
@@ -842,11 +844,12 @@ gif_input(struct gif_tunnel *key, struct
 	}
 #endif
 
+	*mp = NULL;
 	(*input)(ifp, m);
 	return (IPPROTO_DONE);
 
  drop:
-	m_freem(m);
+	m_freemp(mp);
 	return (IPPROTO_DONE);
 }