I would rephrase this sentence to:
... policies is to make sure that .... (no comma, s/just/to/)

This sentence sounds strange, maybe there is a word missing or at the wrong position?
Is this what you meant:

... value, each packet handled by IPsec will be checked ...

You need to bump this document date, too.

This date needs to be bumped.

I think this can be committed independently right now?

I try to describe what I mean:

if (check_policy_history != 0) { // <- this variable has non-zero value

IPsec has handled a packet. This packet must have history, i.e. list of operations that IPsec did.
Each entry in the list contains the following information: protocol, mode, SA address:

struct xform_history {
        union sockaddr_union    dst;            /* destination address */
        uint32_t                spi;            /* Security Parameters Index */
        uint8_t                 proto;          /* IPPROTO_ESP or IPPROTO_AH */
        uint8_t                 mode;           /* transport or tunnel */
};

Security policy has a list of operation, that administrator requires, e.g.
ipsec esp/tunnel/SRC-DST/require ah/transport//require;

Now we compare each entry in the history with the entries in the policy.
If they don't match, the kernel will drop packet.

} else {

Each packet has flags, that some sort of IPsec operation was done.
The kernel checks that some encryption was used and some AH SA was used. 
But the kernel doesn't check SA addresses.

}

Needs an article: s/of/of the/

Also, igor says there is trailing whitespace on this line.

s/the following/this/

IPv[46] looks ugly. What it means is clear if the reader expects filename-type wildcards, but is it normally stated this way?

Also, ESP is not defined.

Is this clearer?

It can tunnel IPv4 and IPv6 traffic over either IPv4 or IPv6 and secure it with ESP.

s/needs to/must/

s/endpoints/endpoint/

s/also can/can also/

Needs an article: s/When/When the/

Also, igor says there is trailing whitespace on this line.

Break this sentence here:

interface is configured, it automatically creates special security policies.
These policies can be used to acquire security associations from the IKE daemon,
which are needed for establishing an IPsec tunnel.

Needs an article: s/has/has an/

s/used/is used/

s/creating/creation/

s/it is//

s/of//

s/of//

s/Assuming host/Host/

Should be used? Or really *must* be used?

Also, igor says there is trailing whitespace on this line.

s/from/on/

s/The/A/

Some would say "properly-formed" should have a hyphen.

Needs article: s/for/for the/

s/This variable controls/Control/

Needs article: s/non-zero/a non-zero/

Also, igor says there is trailing whitespace on this line.

igor says there is trailing whitespace on this line.

s/will incrementally recompute/incrementally recomputes/

Avoid contractions: s/weren't/were not/

Passive->active: s/will be/are/

s/This variable enables/Enables/

Hmm. How about:

Default inbound security policies check that packets handled by IPsec
have been decrypted and authenticated.
If this variable is set to a non-zero value, each packet handled by IPsec
is checked against the history of IPsec security associations.
The IPsec security protocol, mode, and SA addresses must match.

Not sure about this, but maybe

When this option is enabled on a socket, all outgoing TCP segments

s/also must/must also/

Passive->active:
s/will not/does not/
s/will drop/drops/

Passive->active: s/will be/is/

s/3948/3948,/

Avoid contractions: s/doesn't/does not/

Needs article: s/as/as a/

s/one of/either/

Trailing whitespace on this line.

s/can not/cannot/

s/flags/the flags/

s/also/is also/
s/In case/When/

s/speedup/speed up/

I prefer to keep commit all changes together to do not introduce merge conflicts.

s/values/value/ (I think).

Still needs an article: s/has/has an/

s/will be/is/

Looking at this sentence, can it just be:

When this option is enabled on a socket, all inbound and outgoing
TCP segments must be signed with MD5 digests.

Each if_ipsec(4) interface has own security policies that should match all traffic.
Due to the constrains in the code that does policy comparison, we need to explicitly specify the address family for a policy. This is similar to setkey's:

spdadd -6 ...  -P out ...
spdadd -6 ... -P in ...
spdadd -4 ... -P out ...
spdadd -4 ... -P in ...

To match both IPv4 and IPv6 we need 4 policies (inbound and outbound).

There are only a few uses of this lock, I used it without macro like in gif(4) and gre(4). From my point of view, the reason why we use macro instead of direct call for locking is ability to change the lock definition and avoid changing in all places of the code. E.g. change mutex to rwlock, or rwlock to rmlock. In this case I don't see suitable candidates for migration.

ipsec_checkpolicy() is generic function for both IPv4 and IPv6. Since we have separate statistics for INET and INET6 ipsec, I moved statistic accounting in AF-specific functions, i.e. ipsec4_checkpolicy() and ipsec6_checkpolicy().