For NIC TLS RX support we may end up making this bit of code a helper routine that can be shared with the NIC TLS RX path.

Could the record_type be extracted outside this function? We will need this for the hardware decrypted traffic.

Sounds like a good idea, to factor this bit out. Then you don't really need two separate decryption functions.

You would still need separate decryption functions as some of the other details are different such as the AAD. I think splitting out this routine is probably something sensible to do in a future commit in a series adding 1.3 NIC TLS RX, but I might move it back to sys/kern/uipc_ktls.c. I had started with doing it in uipc_ktls.c but found it simpler to do it here instead.

Should we have another callback function into OCF, which handle already decrypted traffic, to get the trailer length and header type fields correct?

I think this version should work for you for NIC TLS as you can fall through to the code below with the decrypted record.