untrusted comment: verify with openbsd-68-base.pub
RWQZj25CSG5R2gnNBM/MLVkbtgEwuNc4kBgrQXFm/4TY0Xb/OwkZ3f38s/We42C6FF/E+g7/FI0axlpGqM7VZinkmHMbxgodago=

OpenBSD 6.8 errata 028, August 11, 2021:

In a specific configuration, wg(4) leaked mbufs.

Apply by doing:
    signify -Vep /etc/signify/openbsd-68-base.pub -x 028_wg.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/net/if_wg.c
===================================================================
RCS file: /cvs/src/sys/net/if_wg.c,v
diff -u -p -u -r1.14 if_wg.c
--- sys/net/if_wg.c	1 Sep 2020 19:06:59 -0000	1.14
+++ sys/net/if_wg.c	5 Aug 2021 14:06:30 -0000
@@ -810,6 +810,7 @@ wg_send(struct wg_softc *sc, struct wg_e
 			    IPPROTO_IPV6);
 #endif
 	} else {
+		m_freem(m);
 		return EAFNOSUPPORT;
 	}