diff --git a/sys/netinet6/ip6_mroute.c b/sys/netinet6/ip6_mroute.c
--- a/sys/netinet6/ip6_mroute.c
+++ b/sys/netinet6/ip6_mroute.c
@@ -668,6 +668,17 @@
 #endif
 	bzero((caddr_t)mifp, sizeof (*mifp));
 
+	/*
+	 * DF-0423: if the deleted mif was the register mif, clear reg_mif_num
+	 * so a later PIM REGISTER (pim6_input) does not dereference the now-
+	 * NULL mif6table[reg_mif_num].m6_ifp via if_simloop(). Without this,
+	 * the stale reg_mif_num (only otherwise cleared in ip6_mrouter_done)
+	 * passes the pim6_input guard `reg_mif_num < nummifs` while the slot's
+	 * m6_ifp is NULL, causing a NULL-deref panic.
+	 */
+	if (reg_mif_num == *mifip)
+		reg_mif_num = (mifi_t)-1;
+
 	/* Adjust nummifs down */
 	for (mifi = nummifs; mifi > 0; mifi--)
 		if (mif6table[mifi - 1].m6_ifp)