The last extension type isn't set in pfkeyv2_sysctl_policydumper(). So fix the bug instead of working around it in export_counter().
ok? Index: net/pfkeyv2.c =================================================================== RCS file: /cvs/src/sys/net/pfkeyv2.c,v retrieving revision 1.193 diff -u -p -r1.193 pfkeyv2.c --- net/pfkeyv2.c 18 Dec 2018 13:18:31 -0000 1.193 +++ net/pfkeyv2.c 9 Jan 2019 18:25:38 -0000 @@ -2567,7 +2567,7 @@ pfkeyv2_sysctl_policydumper(struct ipsec w->w_where += sizeof(msg); w->w_len -= sizeof(msg); /* set extension type */ - for (i = 1; i < SADB_EXT_MAX; i++) + for (i = 1; i <= SADB_EXT_MAX; i++) if (headers[i]) ((struct sadb_ext *) headers[i])->sadb_ext_type = i; Index: net/pfkeyv2_convert.c =================================================================== RCS file: /cvs/src/sys/net/pfkeyv2_convert.c,v retrieving revision 1.64 diff -u -p -r1.64 pfkeyv2_convert.c --- net/pfkeyv2_convert.c 28 Aug 2018 15:15:02 -0000 1.64 +++ net/pfkeyv2_convert.c 9 Jan 2019 18:21:23 -0000 @@ -904,9 +904,8 @@ export_counter(void **p, struct tdb *tdb { struct sadb_x_counter *scnt = (struct sadb_x_counter *)*p; - scnt->sadb_x_counter_len = - sizeof(struct sadb_x_counter) / sizeof(uint64_t); - scnt->sadb_x_counter_exttype = SADB_X_EXT_COUNTER; + scnt->sadb_x_counter_len = sizeof(struct sadb_x_counter) / + sizeof(uint64_t); scnt->sadb_x_counter_ipackets = tdb->tdb_ipackets; scnt->sadb_x_counter_opackets = tdb->tdb_opackets; scnt->sadb_x_counter_ibytes = tdb->tdb_ibytes;