There is an invalid udp header length calculation in ipsec code:

src/vnet/ipsec/esp_encrypt.c:395

ouh0->udp.length =
clib_host_to_net_u16 (oh0->ip4.length - ip4_header_bytes (&oh0->ip4));		

since oh0->ip4.length is already in a network order resulting udp length will be invalid.