FAST_IPSEC doesn't send ICMP frag needed

[Dave Huang <khym%azeotrope.org@localhost>]

It appears that (FAST_)IPSEC doesn't send ICMP fragmentation needed
when it gets a Don't Fragment packet that needs to be fragmented
because of encapsulation overhead. Beverly Schwartz posted an analysis
of the problem last year
<http://mail-index.netbsd.org/tech-net/2012/10/16/msg003674.html>, but
nobody said anything :(

Does anyone have thoughts about the proposed fix in that message? My
IPSEC tunnel isn't working right, probably due to AT&T lossage--
AFAICT, fragmented packets aren't making it out... tcpdump on my end
of the tunnel shows an ESP packet fragmented into two pieces being
sent out. However, only the first fragment makes it to the other end
of the tunnel; the second one is nowhere to be seen. Fragmented pings
(not in an IPSEC tunnel) aren't making it out either. I'd like to work
around it by not sending fragmented packets, but PMTUD is broken
because NetBSD isn't sending ICMP fragmentation needed.
-- 
Name: Dave Huang         |  Mammal, mammal / their names are called /
INet: khym%azeotrope.org@localhost |  they raise a paw / the bat, the cat /
FurryMUCK: Dahan         |  dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 38 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++