--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -2184,7 +2184,12 @@ icmp6_redirect_input(struct mbuf *m, int off)
 
 #ifndef PULLDOWN_TEST
 	IP6_EXTHDR_CHECK(m, off, icmp6len,);
+	/*
+	 * m may have been reallocated by m_pullup() inside the check when
+	 * M_LOOP is set (see the comment in icmp6_input()); re-derive ip6.
+	 * All uses below (nd_rd, ip6->ip6_hlim) depend on this.
+	 */
+	ip6 = mtod(m, struct ip6_hdr *);
 	nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
 #else
 	IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);