untrusted comment: verify with openbsd-75-base.pub
RWRGj1pRpprAftVfUP/AVFEX44/5EmaEBZaDdN9E13hPf2Why5rsuciroMnEzxrDOHiHNMkmCsj51GpwCFc40GByi1n4p3LmawA=

OpenBSD 7.5 errata 022, April 9, 2025:

iked(8) and isakmpd(8) fix double-free in ecdh mode.

Apply by doing:
    signify -Vep /etc/signify/openbsd-75-base.pub -x 022_ike.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install iked and isakmpd:
    cd /usr/src/sbin/iked
    make obj
    make
    make install
    cd /usr/src/sbin/isakmpd
    make obj
    make
    make install

Index: sbin/iked/dh.c
===================================================================
RCS file: /cvs/src/sbin/iked/dh.c,v
diff -u -p -r1.33 dh.c
--- sbin/iked/dh.c	28 Jul 2023 07:31:38 -0000	1.33
+++ sbin/iked/dh.c	25 Mar 2025 15:02:49 -0000
@@ -670,9 +670,9 @@ ec_raw2point(struct dh_group *group, uin
 {
 	const EC_GROUP	*ecgroup = NULL;
 	EC_POINT	*point = NULL;
+	EC_POINT	*ret = NULL;
 	BN_CTX		*bnctx = NULL;
 	BIGNUM		*x = NULL, *y = NULL;
-	int		 ret = -1;
 	size_t		 eclen;
 	size_t		 xlen, ylen;
 
@@ -700,10 +700,12 @@ ec_raw2point(struct dh_group *group, uin
 	if (!EC_POINT_set_affine_coordinates(ecgroup, point, x, y, bnctx))
 		goto done;
 
-	ret = 0;
+	/* success */
+	ret = point;
+	point = NULL;	/* owned by caller */
+
  done:
-	if (ret != 0 && point != NULL)
-		EC_POINT_clear_free(point);
+	EC_POINT_clear_free(point);
 	/* Make sure to erase sensitive data */
 	if (x != NULL)
 		BN_clear(x);
@@ -712,7 +714,7 @@ ec_raw2point(struct dh_group *group, uin
 	BN_CTX_end(bnctx);
 	BN_CTX_free(bnctx);
 
-	return (point);
+	return (ret);
 }
 
 int
Index: sbin/isakmpd/dh.c
===================================================================
RCS file: /cvs/src/sbin/isakmpd/dh.c,v
diff -u -p -r1.27 dh.c
--- sbin/isakmpd/dh.c	31 Mar 2023 07:28:46 -0000	1.27
+++ sbin/isakmpd/dh.c	25 Mar 2025 15:02:49 -0000
@@ -581,9 +581,9 @@ ec_raw2point(struct group *group, u_int8
 {
 	const EC_GROUP	*ecgroup = NULL;
 	EC_POINT	*point = NULL;
+	EC_POINT	*ret = NULL;
 	BN_CTX		*bnctx = NULL;
 	BIGNUM		*x = NULL, *y = NULL;
-	int		 ret = -1;
 	size_t		 eclen;
 	size_t		 xlen, ylen;
 
@@ -611,10 +611,12 @@ ec_raw2point(struct group *group, u_int8
 	if (!EC_POINT_set_affine_coordinates(ecgroup, point, x, y, bnctx))
 		goto done;
 
-	ret = 0;
+	/* success */
+	ret = point;
+	point = NULL;	/* owned by caller */
+
  done:
-	if (ret != 0 && point != NULL)
-		EC_POINT_clear_free(point);
+	EC_POINT_clear_free(point);
 	/* Make sure to erase sensitive data */
 	if (x != NULL)
 		BN_clear(x);
@@ -623,5 +625,5 @@ ec_raw2point(struct group *group, u_int8
 	BN_CTX_end(bnctx);
 	BN_CTX_free(bnctx);
 
-	return (point);
+	return (ret);
 }