Looks like a similar issue with a different cause (in this case the kernel seems to be assuming that IPSec packet contents were already checksummed by the outer IPSec packet and thus correct).

Just skimmed it; very interesting. I hadn't heard of this bug before, but will read it in detail soon. Thanks!