In both ESP encrypt and decrypt, a new buffer is allocated for the encrypted and decrypted data respectively, which is likely the reason the buffer is not speculatively enqueued at the top of the loop.
There are some exception paths (sequence overflow, anti-replay, failed authentication, etc) where execution flow jumps to trace: and then vlib_validate_buffer_enqueue_x1.

Issue is we validate the buffer that was never enqueued in the next frame yet.