DF-3418 — rtentry reference leak in in6_ifdetach_dispatch (in6_ifattach.c:844-849)

in6_ifdetach_dispatch() removes the ff02::1%ifp route on interface detach:

rt = rtpurelookup((struct sockaddr *)&sin6);
if (rt != NULL && rt->rt_ifp == ifp) {
        --rt->rt_refcnt;
        rtrequest(RTM_DELETE, ...);
}

rtpurelookup() → _rtlookup() unconditionally bumps rt->rt_refcnt on a match (sys/net/route.c:276). When the longest-prefix match lands on a route owned by a different interface — e.g. the IPv6 default route, when the detached interface never carried the specific ff02::1 host route — the rt_ifp != ifp case returns without dropping the reference. The +1 reference is permanent: a later RTM_DELETE of that route unlinks it from the radix tree but rtfree() never reaches 0, so the rtentry and its sockaddrs are retained forever.

Reproduce (on the guest, as root)

route add -inet6 default -iface vtnet0            # foreign route to match
vmstat -m | grep routetbl                          # baseline
for i in $(seq 1 10); do
        route delete -inet6 default >/dev/null 2>&1
        route add -inet6 default -iface vtnet0 >/dev/null 2>&1
        ifconfig tap0 create   >/dev/null 2>&1
        ifconfig tap0 destroy  >/dev/null 2>&1    # <- in6_ifdetach leaks ref
done
vmstat -m | grep routetbl                          # +~1.8 objects/cycle

Expected result (observed on stock INVARIANTS kernel, 6-cpu guest)

Each interface destroy with a foreign IPv6 route in the table permanently pins one rtentry; deleting the route afterwards leaks the allocation. Unbounded repetition leaks unbounded kernel memory (slow kernel-memory exhaustion from routine admin operations).

Fix

Drop the reference on every non-NULL lookup result (the delete branch keeps its own accounting):

--- a/sys/netinet6/in6_ifattach.c
+++ b/sys/netinet6/in6_ifattach.c
@@ -841,8 +841,10 @@
    sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
    rt = rtpurelookup((struct sockaddr *)&sin6);
-   if (rt != NULL && rt->rt_ifp == ifp) {
-       --rt->rt_refcnt;
+   if (rt != NULL) {
+       if (rt->rt_ifp == ifp)
+           --rt->rt_refcnt;
+       else
+           rtfree(rt); /* not ours: drop lookup ref */
+   }
+   if (rt != NULL && rt->rt_ifp == ifp) {
        rtrequest(RTM_DELETE, (struct sockaddr *)rt_key(rt),
            rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
    }

(The exact shape may vary; the requirement is: the +1 taken by rtpurelookup() must be dropped on all paths.)