diff --git a/sys/netipsec/ipsec_support.h b/sys/netipsec/ipsec_support.h
index e779ba96dea..491a6ff59a2 100644
--- a/sys/netipsec/ipsec_support.h
+++ b/sys/netipsec/ipsec_support.h
@@ -193,8 +193,7 @@ int ipsec_kmod_pcbctl(struct ipsec_support * const, struct inpcb *,
     struct sockopt *);
 int ipsec_kmod_capability(struct ipsec_support * const, struct mbuf *, u_int);
 size_t ipsec_kmod_hdrsize(struct ipsec_support * const, struct inpcb *);
-int ipsec_kmod_ctlinput(struct ipsec_support * const, int,
-    struct sockaddr *, void *);
+int ipsec_kmod_ctlinput(struct ipsec_support *, ipsec_ctlinput_param_t);
 int ipsec_kmod_udp_input(struct ipsec_support * const, struct mbuf *, int, int);
 int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *,
     struct sockopt *);
diff --git a/sys/netipsec/subr_ipsec.c b/sys/netipsec/subr_ipsec.c
index 13c7336154e..3eac9d6aaad 100644
--- a/sys/netipsec/subr_ipsec.c
+++ b/sys/netipsec/subr_ipsec.c
@@ -367,8 +367,8 @@ IPSEC_KMOD_METHOD(int, ipsec_kmod_forward, sc,
 )
 
 IPSEC_KMOD_METHOD(int, ipsec_kmod_ctlinput, sc,
-    ctlinput, METHOD_DECL(struct ipsec_support * const sc, int code,
-        struct sockaddr *sa, void *v), METHOD_ARGS(code, sa, v)
+    ctlinput, METHOD_DECL(struct ipsec_support * const sc,
+	ipsec_ctlinput_param_t param), METHOD_ARGS(param)
 )
 
 IPSEC_KMOD_METHOD(int, ipsec_kmod_output, sc,