Apply by doing:
	cd /usr/src
	patch -p0 < 003_getsockopt.patch

Then build and install a new kernel.

Index: sys/netinet/ip_output.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_output.c,v
retrieving revision 1.194
diff -u -p -r1.194 ip_output.c
--- sys/netinet/ip_output.c	5 Jun 2009 00:05:22 -0000	1.194
+++ sys/netinet/ip_output.c	28 Oct 2009 20:10:44 -0000
@@ -1505,6 +1505,7 @@ ip_ctloutput(op, so, level, optname, mp)
 		case IP_ESP_TRANS_LEVEL:
 		case IP_ESP_NETWORK_LEVEL:
 		case IP_IPCOMP_LEVEL:
+			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 #ifndef IPSEC
 			m->m_len = sizeof(int);
 			*mtod(m, int *) = IPSEC_LEVEL_NONE;
Index: sys/netinet6/ip6_output.c
===================================================================
RCS file: /cvs/src/sys/netinet6/ip6_output.c,v
retrieving revision 1.106
diff -u -p -r1.106 ip6_output.c
--- sys/netinet6/ip6_output.c	22 Oct 2008 14:36:08 -0000	1.106
+++ sys/netinet6/ip6_output.c	28 Oct 2009 21:09:05 -0000
@@ -1892,6 +1892,7 @@ do { \
 			case IPV6_ESP_TRANS_LEVEL:
 			case IPV6_ESP_NETWORK_LEVEL:
 			case IPV6_IPCOMP_LEVEL:
+				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 #ifndef IPSEC
 				m->m_len = sizeof(int);
 				*mtod(m, int *) = IPSEC_LEVEL_NONE;