r361390 decreased blocksize of AES-CTR from 16 to 1. Because of that ESP payload is no longer aligned to 16 bytes before being encrypted and sent.
This is a good change since RFC3686 specifies that the last block doesn't need to be aligned.
Because FreeBSD before r361390 couldn't decrypt partial blocks encrypted with AES-CTR we need to enforce 16 byte alignment in order to preserve compatibility.
Add a sysctl(on by default) to control it.

Create ipsec tunnel with FreeBSD host without r361390 and use AES-CTR encryption.
Ping it, turn the sysctl off, try to ping it again and verify that connectivity was lost.
Do a similar test connecting to a Linux host and FreeBSD with this patch applied.