Same bug in esp6_input not covered by f4c50a4034. PoC in ipv6/. ESP packet padded to >= 40 bytes for the v6-only size gate.