Yes, I commented this over at netgate as well. If you'd like to work around the vulnerability, you will need to disable both, [email protected] encryption and [email protected] MACs. Keeping either of them enabled still allows for exploitation.