Looks like it was caused by result confusion: crypto_dispatch returns errors in two different ways:

https://man.freebsd.org/cgi/man.cgi?query=crypto_dispatch&ap...

"crypto_dispatch() returns an error if the request contained invalid fields, or zero if the request was valid."

However, on an actual error from the crypto driver (e.g. invalid MAC), crypto_dispatch result is successful and the error is returned in crp_etype structure field.

https://cgit.freebsd.org/src/commit/sys/dev/wg?id=3427182452...