BUG – v.6.44 on ARM boxes RB3011 is losing IPSEC configuration

After upgrade of ARM boxes (RB3011) to latest stable version 6.44, IPSEC is not working.
Winbox GUI /ip ipsec section in is empty and no new config parameters can be added;
In console /ip ipsec export gives just info that all subsections can’t be exported.

The same problem on some RB2011 (mipsBE) device too.

Console output:
/ip ipsec profile> add .....
error - contact MikroTik support and send a supout file

/ip ipsec export
#error exporting /ip ipsec mode-config
#error exporting /ip ipsec peer
#error exporting /ip ipsec policy group
#error exporting /ip ipsec profile
#error exporting /ip ipsec proposal
#error exporting /ip ipsec identity
#error exporting /ip ipsec policy
#error exporting /ip ipsec settings

Upgrade was done from latest stable 6.43.12 to next release stable 6.44.

Have you ever had 6.44beta versions installed on these routers? If not, please send us supout.rif files from the devices to support@mikrotik.com

I would like to know how is it possible that new installation doesn't wipe the system files enough so there could remain some older residue that affect behaviour of the newer version.

It is not the system files but configuration.

I have a relatively complex IPsec configuration (tunnels to five end-points, running on three different non-Mikrotik platforms, both IPv4 and IPv6, plus an L2TP-over-IPsec dial-in VPN which I configuration in pieces using the IPsec menus directly rather than the "IPsec secret" option on the L2TP side) and I was wondering how high-risk the upgrade to 6.44 is, or should I wait for 6.45 (or at least 6.44.1)? These sorts of threads are quite scary.

I have a relatively complex IPsec configuration (tunnels to five end-points, running on three different non-Mikrotik platforms, both IPv4 and IPv6, plus an L2TP-over-IPsec dial-in VPN which I configuration in pieces using the IPsec menus directly rather than the "IPsec secret" option on the L2TP side) and I was wondering how high-risk the upgrade to 6.44 is, or should I wait for 6.45 (or at least 6.44.1)? These sorts of threads are quite scary.

Unless 6.44 has something you really need asap I would wait for 6.44.1 and IPSec fix.

I started to sanitize configs for production of cleaner supout file.
But after several reboots, /ip ipsec section is accessible again.
Off course all IPsec config was lost and should be re-added from pre upgrade backups.
Now all boxes restored in working state.

Platform summary - The problem was on all 4 my RB3011 ARM boxes and 2 (of several) RB2011 boxes. My x86 installations or TILE devices was not affected.