(Perhaps udp_set_kernel_tunneling() should either succeed or panic?)

It currently can't actually fail when we're clearing a tunnel function (as we do here). It can only fail if a tunnel function is already set, which his not something that should happen to the OpenVPN socket.
Some other callers do the same, some attempt to handle the error.
Looking at that code though ... basically everyone creates a new socket and then calls udp_set_kernel_tunneling(). I don't expect it to be possible for those calls to fail, so maybe it would indeed be better to just assert in udp_set_kernel_tunneling() itself.

It looks like if_ovpn is the only case where we don't create the socket before we attach the tunneling function.