IPSec offload on ERX blocks gre/IPSec site-to-site between dynamic peers with FQDN

Hi, I have been working on setting up gre/IPSec connection between 2 sites both with dynamic IP address with FQDN (DDNS) assigned, based on these posts below. I use ERX with v1.9.0 firmware for both sites. I need routable interface so I used to use OpenVPN site-to-site which worked flawlessly, then I switched to gre/IPSec recently expecting more bandwidth because of IPSec itself and hardware offload on ERX with v1.9.0 firmware.

https://community.ubnt.com/t5/EdgeMAX-Beta/Routed-IP-VTI-or-GRE-over-IPSec-with-dynamic-peer/m-p/1649932#M18083

https://community.ubnt.com/t5/EdgeMAX/My-HowTo-on-multiple-dynamic-ospf-gre-ipsec-tunnels/m-p/1253094/highlight/true#M65371

I basically set up gre tunnel using loopback address, and IPSec tunnel using FQDN for both sites, with specifying prefix (/32) using the same loopback address for gre. It worked if IPSec offload is not enabled, then traffic between 2 sites stops once IPSec offload is enabled.

[Router A]
LAN:
192.168.101.0/24
WAN:
eth0 (dhcp)

loopback:
192.168.112.1/32

gre tunnel address:
192.168.122.1/30
gre local-ip:
192.168.112.1
gre remote-ip:
192.168.112.2

ipsec-interfaces
eth0
IPSec site-to-site peer routerB.XXXX.com dhcp-interface
eth0
IPSec site-to-site peer routerB.XXXX.com tunnel 1 local prefix
192.168.112.1/32
IPSec site-to-site peer routerB.XXXX.com tunnel 1 remote prefix
192.168.112.2/32

[Router B]
LAN:
192.168.102.0/24
WAN:
pppoe0 on eth0 (dhcp)

loopback:
192.168.112.2/32

gre tunnel address:
192.168.122.2/30
gre local-ip:
192.168.112.2
gre remote-ip:
192.168.112.1

ipsec-interfaces
pppoe0
IPSec site-to-site peer routerA.XXXX.com local-address
0.0.0.0
IPSec site-to-site peer routerA.XXXX.com tunnel 1 local prefix
192.168.112.2/32
IPSec site-to-site peer routerA.XXXX.com tunnel 1 remote prefix
192.168.112.1/32

I tried opening up firewall completely by adding a rule to accept everything for both sites (IN and LOCAL) but nothing works. Again, if I disable IPSec offload, the traffic comes back, I can ping both sites and routing starts flowing.

Here are the configs for both sites without IPSec offload, which means these configs work. I’m not sure if it is a bug for offload on V1.9.0, histrocial bug for IPSec itself without offload, or if I miss something for firewall etc. but it would be great if I can have some feedback.