Errata patches for IPsec have been released for OpenBSD 6.2 and 6.1. The IPsec AH header could be longer than the network packet, resulting in a kernel crash.
Binary updates for the amd64, i386, and arm64 platforms are available via the syspatch utility. Source code patches can be found on the respective errata pages: https://www.openbsd.org/errata61.html https://www.openbsd.org/errata62.html As these affect the kernel, a reboot will be needed after patching.
