diff --git a/sys/netinet/tcp_lro.h b/sys/netinet/tcp_lro.h
--- a/sys/netinet/tcp_lro.h
+++ b/sys/netinet/tcp_lro.h
@@ -67,12 +67,14 @@
 union lro_address {
 	u_long raw[1];
 	struct {
-		uint16_t lro_type;	/* internal */
+		uint8_t lro_type;	/* internal */
 #define	LRO_TYPE_NONE     0
 #define	LRO_TYPE_IPV4_TCP 1
 #define	LRO_TYPE_IPV6_TCP 2
 #define	LRO_TYPE_IPV4_UDP 3
 #define	LRO_TYPE_IPV6_UDP 4
+		uint8_t lro_flags;
+#define	LRO_FLAG_DECRYPTED 1
 		uint16_t vlan_id;	/* VLAN identifier */
 		uint16_t s_port;	/* source TCP/UDP port */
 		uint16_t d_port;	/* destination TCP/UDP port */
diff --git a/sys/netinet/tcp_lro.c b/sys/netinet/tcp_lro.c
--- a/sys/netinet/tcp_lro.c
+++ b/sys/netinet/tcp_lro.c
@@ -394,6 +394,9 @@
 			po->data.vlan_id =
 			    htons(m->m_pkthdr.ether_vtag) & htons(EVL_VLID_MASK);
 		}
+		/* Store decrypted flag, if any. */
+		if (__predict_false(m->m_flags & M_DECRYPTED))
+			po->data.lro_flags |= LRO_FLAG_DECRYPTED;
 	}
 
 	switch (po->data.lro_type) {
@@ -1583,7 +1586,7 @@
 	uint32_t *ts_ptr;
 	int32_t n_mbuf;
 	bool other_opts, can_compress;
-	uint16_t lro_type;
+	uint8_t lro_type;
 	uint16_t iptos;
 	int tcp_hdr_offset;
 	int idx;