The selector ports are initialized to fl_ip_sport/fl_ip_dport instead of xfrm_flowi_sport(fl)/xfrm_flowi_dport(fl). This is wrong for ICMP, type and code should be stored in sport and dport, in struct flowi both are contained in fl_ip_sport.