2026-05-28, Sabrina Dubroca wrote:

But the packet is delivered correctly also in the bridge case, right?
Once we enter async crypto, the original datapath becomes irrelevant.

Yes — async completion via xfrm_output_resume() -> dst_output() delivers it
correctly regardless of the bridge TX path. The -ENOMEM is just a misleading
return code to the caller, not an actual drop.

Your ERR_PTR(-EINPROGRESS) approach makes sense. I'll work on a v2 based on
that — propagate through validate_xmit_xfrm() and fix up the callers.

Thanks for the pointer to f53c723902d1, that explains the context well.

Petr