graph. In particular, this solves some issues with (probably leaked) IPSec-related tags being looped back through netgraph to the inbound path which then misinterpreted the stale tags. MFC after: 7 days