in6_ifremloop leaks rtentry refcount when matched route is not loopback host route

Summary

rtpurelookup returns rt with refcnt++. in6_ifaddloop(:270-271) drops unconditionally. in6_ifremloop(:318-325) only drops inside RTF_HOST+IFF_LOOPBACK predicate. Non-matching route -> refcnt leaked -> route never freed. Slow memory exhaustion. Root SIOCDIFADDR_IN6.