diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 1f8e6abb594b..354157b74085 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1608,7 +1608,9 @@ ipsec4_hdrsiz(m, dir, inp)
 
 		KEY_FREESP(&sp);
 	} else {
-		size = 0;	/* XXX should be panic ? */
+		size = 0;	/* XXX should be panic ?
+				 * -> No, we are called w/o knowing if
+				 *    IPsec processing is needed. */
 	}
 	return size;
 }