Of course one clever way of doing BITW is to have some cooperation from
the host. Specifically the host puts in a skeletal AH header where it
wants the real AH header to go and the bump finished the job. Presumably
the reason you are using a BITW is because it has hardware encryption
support and can do the processing more efficiently.
-Jeff