IPsec needs IPv4/IPv6 input validation
IPsec GUI input validation needs some work for IPv6.
If you choose IPv4 or IPv6 on the Phase 1 settings, addresses of the incorrect family should be rejected in the peer address.
Similarly, addresses of the wrong type should be rejected in Phase 2 based on the "Tunnel IPv4" or "Tunnel IPv6" choice.
And if they cannot be mixed, selecting "IPv4" on Phase 1 should cause "Tunnel IPv6" to be rejected in Phase 2 and vice versa.