CURRENT: kernel fails to compile when "options IPSEC"

Recent sources (309143-309194) do not build kernel due to:

[...]
Building /usr/obj/usr/src/sys/SB21X1/ipsec_mbuf.o
In file included from /usr/src/sys/netipsec/ipsec_mbuf.c:43:
In file included from /usr/src/sys/netipsec/ipsec.h:46:
In file included from /usr/src/sys/netipsec/keydb.h:38:
/usr/src/sys/sys/mutex.h:367:2: error: LOCK_DEBUG not defined, include <sys/lock.h>
before <sys/mutex.h> #error LOCK_DEBUG not defined, include <sys/lock.h> before
<sys/mutex.h> ^
/usr/src/sys/sys/mutex.h:369:5: error: 'LOCK_DEBUG' is not defined, evaluates to 0
[-Werror,-Wundef] #if LOCK_DEBUG > 0 || defined(MUTEX_NOINLINE)
    ^
2 errors generated.
*** Error code 1


This error can be avoided by following the suggestion made, patching sys/netipsec/keydb.h:

--- sys/netipsec/keydb.h        (revision 309194)
+++ sys/netipsec/keydb.h        (working copy)
_at__at_ -35,6 +35,8 _at__at_
 
 #ifdef _KERNEL
 
+#include <sys/lock.h>
+
 #include <sys/mutex.h>
 
 #include <netipsec/key_var.h>


Can someone please fix this?

I'm not sure whether the include <sys/lock.h> is the correct palce in this case or has to
show up earlier in the include-chain.

oh