Index: sys/netipsec/key.c
===================================================================
--- sys/netipsec/key.c
+++ sys/netipsec/key.c
@@ -6263,7 +6263,8 @@
     u_int16_t* max)
 {
 
-	*min = *max = ah->keysize;
+	*min = 0;
+	*max = ah->keysize;
 	if (ah->keysize == 0) {
 		/*
 		 * Transform takes arbitrary key size but algorithm