--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -406,8 +406,14 @@
 	 * Installing a link-layer address might change the state of the
 	 * router's neighbor cache, which might also affect our on-link
 	 * detection of adveritsed prefixes.
+	 *
+	 * NOTE: Serialized with nd6_mtx; pfxlist_onlink_check() walks and
+	 * mutates the global prefix list and dereferences nd_defrouter
+	 * pointers that nd6_timer (expiry sweep) frees under nd6_mtx.
 	 */
+	mtx_lock(&nd6_mtx);
 	pfxlist_onlink_check();
+	mtx_unlock(&nd6_mtx);
     }
 
 freeit: