diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c
index 230e316ea77d..0a722140f93e 100644
--- a/sys/netipsec/ipsec_output.c
+++ b/sys/netipsec/ipsec_output.c
@@ -344,7 +344,7 @@ ipsec4_check_pmtu(struct mbuf *m, struct secpolicy *sp, int forwarding)
 	if (m_length(m, NULL) + hlen > pmtu) {
 		/*
 		 * If we're forwarding generate ICMP message here,
-		 * so that it contains pmtu subtraced by header size.
+		 * so that it contains pmtu subtracted by header size.
 		 * Set error to EINPROGRESS, in order for the frame
 		 * to be dropped silently.
 		 */