Replying to
@whitequark@social.treehouse.systems as a quick hack, blocking the xfrm_algo module from loading prevents this one (tested on amazon linux 2023)
edit: for distros that build it into the kernel this won't work, but there's probably some function to add to the initcall_blacklist cmdline argument like the copyfail mitigation on RHEL
