Index: sys/netinet6/ip6_output.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/ip6_output.c,v
retrieving revision 1.216
diff -p -u -r1.216 ip6_output.c
--- sys/netinet6/ip6_output.c	22 Dec 2018 14:28:57 -0000	1.216
+++ sys/netinet6/ip6_output.c	4 Feb 2019 10:42:26 -0000
@@ -1702,9 +1702,9 @@ else 					\
 				error = ipsec_set_policy(in6p,
 				    sopt->sopt_data, sopt->sopt_size,
 				    kauth_cred_get());
-				break;
-			}
-			/*FALLTHROUGH*/
+			} else
+				error = ENOPROTOOPT;
+			break;
 #endif /* IPSEC */
 
 		default:
@@ -1910,9 +1910,9 @@ else 					\
 				    sopt->sopt_size, &m);
 				if (!error)
 					error = sockopt_setmbuf(sopt, m);
-				break;
-			}
-			/*FALLTHROUGH*/
+			} else
+				error = ENOPROTOOPT;
+			break;
 #endif /* IPSEC */
 
 		default:
Index: sys/netinet/ip_output.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/ip_output.c,v
retrieving revision 1.309
diff -p -u -r1.309 ip_output.c
--- sys/netinet/ip_output.c	22 Dec 2018 13:11:38 -0000	1.309
+++ sys/netinet/ip_output.c	4 Feb 2019 10:42:26 -0000
@@ -1238,9 +1238,9 @@ ip_ctloutput(int op, struct socket *so, 
 				error = ipsec_set_policy(inp,
 				    sopt->sopt_data, sopt->sopt_size,
 				    curlwp->l_cred);
-				break;
-			}
-			/*FALLTHROUGH*/
+			} else 
+				error = ENOPROTOOPT;
+			break;
 #endif /* IPSEC */
 
 		default: