Index: nfs/nfs_node.c
===================================================================
RCS file: /cvsroot/src/sys/nfs/nfs_node.c,v
retrieving revision 1.110
diff -u -p -r1.110 nfs_node.c
--- nfs/nfs_node.c	15 Mar 2009 17:20:10 -0000	1.110
+++ nfs/nfs_node.c	28 Apr 2009 13:06:00 -0000
@@ -217,7 +217,9 @@ loop:
 			kmem_free(np->n_fhp, fhsize);
 		}
 		pool_put(&nfs_vattr_pool, np->n_vattr);
+		np->n_vattr = NULL;
 		pool_put(&nfs_node_pool, np);
+		np = NULL;
 		ungetnewvnode(vp);
 		goto loop;
 	}
@@ -312,6 +314,7 @@ nfs_reclaim(void *v)
 		kmem_free(np->n_fhp, np->n_fhsize);
 
 	pool_put(&nfs_vattr_pool, np->n_vattr);
+	np->n_vattr = NULL;
 	if (np->n_rcred)
 		kauth_cred_free(np->n_rcred);
 
@@ -324,6 +327,7 @@ nfs_reclaim(void *v)
 	}
 	genfs_node_destroy(vp);
 	pool_put(&nfs_node_pool, np);
+	np = NULL;
 	vp->v_data = NULL;
 	return (0);
 }
Index: nfs/nfs_srvsocket.c
===================================================================
RCS file: /cvsroot/src/sys/nfs/nfs_srvsocket.c,v
retrieving revision 1.3
diff -u -p -r1.3 nfs_srvsocket.c
--- nfs/nfs_srvsocket.c	14 Mar 2009 15:36:24 -0000	1.3
+++ nfs/nfs_srvsocket.c	28 Apr 2009 13:06:00 -0000
@@ -396,6 +396,7 @@ nfsrv_dorec(struct nfssvc_sock *slp, str
 	if (error) {
 		m_freem(nam);
 		nfsdreq_free(nd);
+		nd = NULL;
 		return (error);
 	}
 	*ndp = nd;
@@ -500,6 +501,7 @@ again:
 		m_free(nd->nd_nam2);
 	}
 	nfsdreq_free(nd);
+	nd = NULL;
 
 	mutex_enter(&slp->ns_lock);
 	KASSERT((slp->ns_flags & SLP_SENDING) != 0);
Index: nfs/nfs_syscalls.c
===================================================================
RCS file: /cvsroot/src/sys/nfs/nfs_syscalls.c,v
retrieving revision 1.147
diff -u -p -r1.147 nfs_syscalls.c
--- nfs/nfs_syscalls.c	10 Apr 2009 19:04:14 -0000	1.147
+++ nfs/nfs_syscalls.c	28 Apr 2009 13:06:00 -0000
@@ -771,6 +771,7 @@ nfsrv_zapsock(struct nfssvc_sock *slp)
 		LIST_REMOVE(nwp, nd_tq);
 		mutex_exit(&nfsd_lock);
 		nfsdreq_free(nwp);
+		nwp = NULL;
 		mutex_enter(&nfsd_lock);
 	}
 	mutex_exit(&nfsd_lock);
Index: net/if.c
===================================================================
RCS file: /cvsroot/src/sys/net/if.c,v
retrieving revision 1.233
diff -u -p -r1.233 if.c
--- net/if.c	12 Feb 2009 19:05:36 -0000	1.233
+++ net/if.c	28 Apr 2009 13:06:00 -0000
@@ -845,7 +845,7 @@ if_rt_walktree(struct rtentry *rt, void 
 	    rt_mask(rt), rt->rt_flags, NULL);
 	KASSERT((rt->rt_flags & RTF_UP) == 0);
 	rt->rt_ifp = NULL;
-	RTFREE(rt);
+	RTFREE(&rt);
 	if (error != 0)
 		printf("%s: warning: unable to delete rtentry @ %p, "
 		    "error = %d\n", ifp->if_xname, rt, error);
Index: net/if_arcsubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_arcsubr.c,v
retrieving revision 1.60
diff -u -p -r1.60 if_arcsubr.c
--- net/if_arcsubr.c	7 Nov 2008 00:20:13 -0000	1.60
+++ net/if_arcsubr.c	28 Apr 2009 13:06:00 -0000
@@ -148,7 +148,7 @@ arc_output(struct ifnet *ifp, struct mbu
 			if (rt->rt_gwroute == 0)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == 0)
 					senderr(EHOSTUNREACH);
Index: net/if_atmsubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_atmsubr.c,v
retrieving revision 1.46
diff -u -p -r1.46 if_atmsubr.c
--- net/if_atmsubr.c	18 Apr 2009 14:58:04 -0000	1.46
+++ net/if_atmsubr.c	28 Apr 2009 13:06:00 -0000
@@ -136,7 +136,7 @@ atm_output(struct ifnet *ifp, struct mbu
 			if (rt->rt_gwroute == 0)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = RTALLOC1(rt->rt_gateway, 0);
 				if ((rt = rt->rt_gwroute) == 0)
 					senderr(EHOSTUNREACH);
Index: net/if_ecosubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_ecosubr.c,v
retrieving revision 1.32
diff -u -p -r1.32 if_ecosubr.c
--- net/if_ecosubr.c	18 Mar 2009 16:00:22 -0000	1.32
+++ net/if_ecosubr.c	28 Apr 2009 13:06:00 -0000
@@ -200,7 +200,7 @@ eco_output(struct ifnet *ifp, struct mbu
 			if (rt->rt_gwroute == 0)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == 0)
 					senderr(EHOSTUNREACH);
Index: net/if_ethersubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_ethersubr.c,v
retrieving revision 1.170
diff -u -p -r1.170 if_ethersubr.c
--- net/if_ethersubr.c	7 Nov 2008 00:20:13 -0000	1.170
+++ net/if_ethersubr.c	28 Apr 2009 13:06:00 -0000
@@ -259,7 +259,7 @@ ether_output(struct ifnet *ifp0, struct 
 			if (rt->rt_gwroute == NULL)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == NULL)
 					senderr(EHOSTUNREACH);
Index: net/if_fddisubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_fddisubr.c,v
retrieving revision 1.77
diff -u -p -r1.77 if_fddisubr.c
--- net/if_fddisubr.c	7 Nov 2008 00:20:13 -0000	1.77
+++ net/if_fddisubr.c	28 Apr 2009 13:06:00 -0000
@@ -253,7 +253,7 @@ fddi_output(struct ifnet *ifp0, struct m
 			if (rt->rt_gwroute == 0)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == 0)
 					senderr(EHOSTUNREACH);
Index: net/if_hippisubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_hippisubr.c,v
retrieving revision 1.37
diff -u -p -r1.37 if_hippisubr.c
--- net/if_hippisubr.c	18 Apr 2009 14:58:05 -0000	1.37
+++ net/if_hippisubr.c	28 Apr 2009 13:06:00 -0000
@@ -119,7 +119,7 @@ hippi_output(struct ifnet *ifp, struct m
 			if (rt->rt_gwroute == 0)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == 0)
 					senderr(EHOSTUNREACH);
Index: net/if_ieee1394subr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_ieee1394subr.c,v
retrieving revision 1.41
diff -u -p -r1.41 if_ieee1394subr.c
--- net/if_ieee1394subr.c	7 Nov 2008 00:20:13 -0000	1.41
+++ net/if_ieee1394subr.c	28 Apr 2009 13:06:01 -0000
@@ -116,7 +116,7 @@ ieee1394_output(struct ifnet *ifp, struc
 			if (rt->rt_gwroute == NULL)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt);
+				rtfree(&rt);
 				rt = rt0;
   lookup:
 				rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
Index: net/if_stf.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_stf.c,v
retrieving revision 1.72
diff -u -p -r1.72 if_stf.c
--- net/if_stf.c	18 Apr 2009 14:58:05 -0000	1.72
+++ net/if_stf.c	28 Apr 2009 13:06:01 -0000
@@ -511,10 +511,10 @@ stf_checkaddr4(struct stf_softc *sc, con
 			    (uint32_t)ntohl(sin.sin_addr.s_addr));
 #endif
 			if (rt)
-				rtfree(rt);
+				rtfree(&rt);
 			return -1;
 		}
-		rtfree(rt);
+		rtfree(&rt);
 	}
 
 	return 0;
Index: net/if_tokensubr.c
===================================================================
RCS file: /cvsroot/src/sys/net/if_tokensubr.c,v
retrieving revision 1.57
diff -u -p -r1.57 if_tokensubr.c
--- net/if_tokensubr.c	18 Apr 2009 14:58:05 -0000	1.57
+++ net/if_tokensubr.c	28 Apr 2009 13:06:01 -0000
@@ -230,7 +230,7 @@ token_output(struct ifnet *ifp0, struct 
 			if (rt->rt_gwroute == 0)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup: rt->rt_gwroute = RTALLOC1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == 0)
 					senderr(EHOSTUNREACH);
Index: net/route.c
===================================================================
RCS file: /cvsroot/src/sys/net/route.c,v
retrieving revision 1.117
diff -u -p -r1.117 route.c
--- net/route.c	2 Apr 2009 21:02:06 -0000	1.117
+++ net/route.c	28 Apr 2009 13:06:01 -0000
@@ -358,10 +358,15 @@ rtalloc1(const struct sockaddr *dst, int
 }
 
 void
-rtfree(struct rtentry *rt)
+rtfree(struct rtentry **_rt)
 {
 	struct ifaddr *ifa;
+	struct rtentry *rt;
+
+	if (_rt == NULL)
+		panic("rtfree");
 
+	rt = *_rt;
 	if (rt == NULL)
 		panic("rtfree");
 	rt->rt_refcnt--;
@@ -380,6 +385,7 @@ rtfree(struct rtentry *rt)
 		rt->rt_ifp = NULL;
 		rt_destroy(rt);
 		pool_put(&rtentry_pool, rt);
+		_rt = NULL;
 	}
 }
 
@@ -457,7 +463,7 @@ rtredirect(const struct sockaddr *dst, c
 			 */
 		create:
 			if (rt != NULL)
-				rtfree(rt);
+				rtfree(&rt);
 			flags |=  RTF_GATEWAY | RTF_DYNAMIC;
 			info.rti_info[RTAX_DST] = dst;
 			info.rti_info[RTAX_GATEWAY] = gateway;
@@ -486,7 +492,7 @@ done:
 		if (rtp != NULL && !error)
 			*rtp = rt;
 		else
-			rtfree(rt);
+			rtfree(&rt);
 	}
 out:
 	if (error)
@@ -527,7 +533,7 @@ rtdeletemsg(struct rtentry *rt)
 	/* Adjust the refcount */
 	if (error == 0 && rt->rt_refcnt <= 0) {
 		rt->rt_refcnt++;
-		rtfree(rt);
+		rtfree(&rt);
 	}
 	return error;
 }
@@ -703,7 +709,7 @@ rtrequest1(int req, struct rt_addrinfo *
 			panic ("rtrequest delete");
 		rt = (struct rtentry *)rn;
 		if (rt->rt_gwroute) {
-			RTFREE(rt->rt_gwroute);
+			RTFREE(&rt->rt_gwroute);
 			rt->rt_gwroute = NULL;
 		}
 		if (rt->rt_parent) {
@@ -727,7 +733,7 @@ rtrequest1(int req, struct rt_addrinfo *
 			*ret_nrt = rt;
 		else if (rt->rt_refcnt <= 0) {
 			rt->rt_refcnt++;
-			rtfree(rt);
+			rtfree(&rt);
 		}
 		break;
 
@@ -759,6 +765,7 @@ rtrequest1(int req, struct rt_addrinfo *
 		if (rt_setkey(rt, dst, M_NOWAIT) == NULL ||
 		    rt_setgate(rt, gateway) != 0) {
 			pool_put(&rtentry_pool, rt);
+			rt = NULL;
 			senderr(ENOBUFS);
 		}
 		RT_DPRINTF("rt->_rt_key = %p\n", (void *)rt->_rt_key);
@@ -790,18 +797,21 @@ rtrequest1(int req, struct rt_addrinfo *
 				rn = rnh->rnh_addaddr(rt_getkey(rt),
 				    netmask, rnh, rt->rt_nodes);
 			}
-			RTFREE(crt);
+			RTFREE(&crt);
 			RT_DPRINTF("rt->_rt_key = %p\n", (void *)rt->_rt_key);
 		}
 		RT_DPRINTF("rt->_rt_key = %p\n", (void *)rt->_rt_key);
 		if (rn == NULL) {
 			IFAFREE(ifa);
-			if ((rt->rt_flags & RTF_CLONED) != 0 && rt->rt_parent)
-				rtfree(rt->rt_parent);
-			if (rt->rt_gwroute)
-				rtfree(rt->rt_gwroute);
+			if ((rt->rt_flags & RTF_CLONED) != 0 && rt->rt_parent) {
+				rtfree(&rt->rt_parent);
+			}
+			if (rt->rt_gwroute) {
+				rtfree(&rt->rt_gwroute);
+			}
 			rt_destroy(rt);
 			pool_put(&rtentry_pool, rt);
+			rt = NULL;
 			senderr(EEXIST);
 		}
 		RT_DPRINTF("rt->_rt_key = %p\n", (void *)rt->_rt_key);
@@ -848,7 +858,7 @@ rt_setgate(struct rtentry *rt, const str
 	RT_DPRINTF("rt->_rt_key = %p\n", (void *)rt->_rt_key);
 
 	if (rt->rt_gwroute) {
-		RTFREE(rt->rt_gwroute);
+		RTFREE(&rt->rt_gwroute);
 		rt->rt_gwroute = NULL;
 	}
 	KASSERT(rt->_rt_key != NULL);
@@ -959,7 +969,7 @@ rtinit(struct ifaddr *ifa, int cmd, int 
 		rt_newaddrmsg(cmd, ifa, error, nrt);
 		if (rt->rt_refcnt <= 0) {
 			rt->rt_refcnt++;
-			rtfree(rt);
+			rtfree(&rt);
 		}
 		break;
 	case RTM_LLINFO_UPD:
@@ -1081,6 +1091,7 @@ rt_timer_queue_remove_all(struct rttimer
 			RTTIMER_CALLOUT(r);
 		/* we are already at splsoftnet */
 		pool_put(&rttimer_pool, r);
+		r = NULL;
 		if (rtq->rtq_count > 0)
 			rtq->rtq_count--;
 		else
@@ -1124,6 +1135,7 @@ rt_timer_remove_all(struct rtentry *rt, 
 			printf("rt_timer_remove_all: rtq_count reached 0\n");
 		/* we are already at splsoftnet */
 		pool_put(&rttimer_pool, r);
+		r = NULL;
 	}
 }
 
@@ -1187,6 +1199,7 @@ rt_timer_timer(void *arg)
 			TAILQ_REMOVE(&rtq->rtq_head, r, rtt_next);
 			RTTIMER_CALLOUT(r);
 			pool_put(&rttimer_pool, r);
+			r = NULL;
 			if (rtq->rtq_count > 0)
 				rtq->rtq_count--;
 			else
@@ -1281,7 +1294,7 @@ rtcache_clear(struct route *ro)
 
 	LIST_REMOVE(ro, ro_rtcache_next);
 
-	RTFREE(ro->_ro_rt);
+	RTFREE(&ro->_ro_rt);
 	ro->_ro_rt = NULL;
 	ro->ro_invalid = false;
 	rtcache_invariants(ro);
Index: net/route.h
===================================================================
RCS file: /cvsroot/src/sys/net/route.h,v
retrieving revision 1.73
diff -u -p -r1.73 route.h
--- net/route.h	2 Apr 2009 21:02:06 -0000	1.73
+++ net/route.h	28 Apr 2009 13:06:01 -0000
@@ -368,7 +368,7 @@ void	 rtcache(struct route *);
 void	 rtflushall(int);
 struct rtentry *
 	 rtalloc1(const struct sockaddr *, int);
-void	 rtfree(struct rtentry *);
+void	 rtfree(struct rtentry **);
 int	 rt_getifa(struct rt_addrinfo *);
 int	 rtinit(struct ifaddr *, int, int);
 int	 rtioctl(u_long, void *, struct lwp *);
@@ -477,12 +477,12 @@ rtcache_validate(const struct route *ro)
 }
 
 static inline void
-RTFREE(struct rtentry *rt)
+RTFREE(struct rtentry **rt)
 {
-	if (rt->rt_refcnt <= 1)
+	if ((*rt)->rt_refcnt <= 1)
 		rtfree(rt);
 	else
-		rt->rt_refcnt--;
+		(*rt)->rt_refcnt--;
 }
 
 int
Index: net/rtsock.c
===================================================================
RCS file: /cvsroot/src/sys/net/rtsock.c,v
retrieving revision 1.125
diff -u -p -r1.125 rtsock.c
--- net/rtsock.c	2 Apr 2009 21:02:06 -0000	1.125
+++ net/rtsock.c	28 Apr 2009 13:06:01 -0000
@@ -462,7 +462,7 @@ flush:
 	if (old_rtm != NULL)
 		Free(old_rtm);
 	if (rt)
-		rtfree(rt);
+		rtfree(&rt);
     {
 	struct rawcb *rp = NULL;
 	/*
Index: netinet/in_gif.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/in_gif.c,v
retrieving revision 1.60
diff -u -p -r1.60 in_gif.c
--- netinet/in_gif.c	7 Nov 2008 00:20:18 -0000	1.60
+++ netinet/in_gif.c	28 Apr 2009 13:06:01 -0000
@@ -337,10 +337,10 @@ gif_validate4(const struct ip *ip, struc
 			    (u_int32_t)ntohl(u.sin.sin_addr.s_addr));
 #endif
 			if (rt != NULL)
-				rtfree(rt);
+				rtfree(&rt);
 			return 0;
 		}
-		rtfree(rt);
+		rtfree(&rt);
 	}
 
 	return 32 * 2;
Index: netinet/ip_icmp.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/ip_icmp.c,v
retrieving revision 1.120
diff -u -p -r1.120 ip_icmp.c
--- netinet/ip_icmp.c	18 Jun 2008 09:06:28 -0000	1.120
+++ netinet/ip_icmp.c	28 Apr 2009 13:06:01 -0000
@@ -629,7 +629,7 @@ reflect:
 				    icp->icmp_ip.ip_dst.s_addr, i);
 		}
 		if (rt != NULL)
-			rtfree(rt);
+			rtfree(&rt);
 
 		pfctlinput(PRC_REDIRECT_HOST, sintosa(&icmpsrc));
 #if defined(IPSEC) || defined(FAST_IPSEC)
@@ -1090,16 +1090,16 @@ icmp_mtudisc(struct icmp *icp, struct in
 		    (struct sockaddr *) 0,
 		    RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt);
 		if (error) {
-			rtfree(rt);
+			rtfree(&rt);
 			return;
 		}
 		nrt->rt_rmx = rt->rt_rmx;
-		rtfree(rt);
+		rtfree(&rt);
 		rt = nrt;
 	}
 	error = rt_timer_add(rt, icmp_mtudisc_timeout, ip_mtudisc_timeout_q);
 	if (error) {
-		rtfree(rt);
+		rtfree(&rt);
 		return;
 	}
 
@@ -1148,7 +1148,7 @@ icmp_mtudisc(struct icmp *icp, struct in
 	}
 
 	if (rt)
-		rtfree(rt);
+		rtfree(&rt);
 
 	/*
 	 * Notify protocols that the MTU for this destination
Index: netinet6/icmp6.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/icmp6.c,v
retrieving revision 1.152
diff -u -p -r1.152 icmp6.c
--- netinet6/icmp6.c	18 Mar 2009 16:00:22 -0000	1.152
+++ netinet6/icmp6.c	28 Apr 2009 13:06:01 -0000
@@ -1134,7 +1134,7 @@ icmp6_mtudisc_update(struct ip6ctlparam 
 		}
 	}
 	if (rt) { /* XXX: need braces to avoid conflict with else in RTFREE. */
-		RTFREE(rt);
+		RTFREE(&rt);
 	}
 
 	/*
@@ -2192,7 +2192,7 @@ icmp6_redirect_input(struct mbuf *m, int
 			    "ICMP6 redirect rejected; no route "
 			    "with inet6 gateway found for redirect dst: %s\n",
 			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-			RTFREE(rt);
+			RTFREE(&rt);
 			goto bad;
 		}
 
@@ -2204,7 +2204,7 @@ icmp6_redirect_input(struct mbuf *m, int
 				"%s\n",
 				ip6_sprintf(gw6),
 				icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-			RTFREE(rt);
+			RTFREE(&rt);
 			goto bad;
 		}
 	} else {
@@ -2214,7 +2214,7 @@ icmp6_redirect_input(struct mbuf *m, int
 			icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
 		goto bad;
 	}
-	RTFREE(rt);
+	RTFREE(&rt);
 	rt = NULL;
     }
 	if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
@@ -2308,7 +2308,7 @@ icmp6_redirect_input(struct mbuf *m, int
 		if (newrt) {
 			(void)rt_timer_add(newrt, icmp6_redirect_timeout,
 			    icmp6_redirect_timeout_q);
-			rtfree(newrt);
+			rtfree(&newrt);
 		}
 	}
 	/* finally update cached route in each socket via pfctlinput */
@@ -2687,17 +2687,17 @@ icmp6_mtudisc_clone(struct sockaddr *dst
 		    (struct sockaddr *) 0,
 		    RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt);
 		if (error) {
-			rtfree(rt);
+			rtfree(&rt);
 			return NULL;
 		}
 		nrt->rt_rmx = rt->rt_rmx;
-		rtfree(rt);
+		rtfree(&rt);
 		rt = nrt;
 	}
 	error = rt_timer_add(rt, icmp6_mtudisc_timeout,
 			icmp6_mtudisc_timeout_q);
 	if (error) {
-		rtfree(rt);
+		rtfree(&rt);
 		return NULL;
 	}
 
Index: netinet6/in6.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/in6.c,v
retrieving revision 1.150
diff -u -p -r1.150 in6.c
--- netinet6/in6.c	18 Apr 2009 14:58:05 -0000	1.150
+++ netinet6/in6.c	28 Apr 2009 13:06:02 -0000
@@ -201,7 +201,7 @@ in6_ifloop_request(int cmd, struct ifadd
 			if (nrt->rt_refcnt <= 0) {
 				/* XXX: we should free the entry ourselves. */
 				nrt->rt_refcnt++;
-				rtfree(nrt);
+				rtfree(&nrt);
 			}
 		} else {
 			/* the cmd must be RTM_ADD here */
@@ -1137,7 +1137,7 @@ in6_update_ifa1(struct ifnet *ifp, struc
 			if (memcmp(&mltaddr.sin6_addr,
 			    &satocsin6(rt_getkey(rt))->sin6_addr,
 			    MLTMASK_LEN)) {
-				RTFREE(rt);
+				RTFREE(&rt);
 				rt = NULL;
 			} else if (rt->rt_ifp != ifp) {
 				IN6_DPRINTF("%s: rt_ifp %p -> %p (%s) "
@@ -1168,7 +1168,7 @@ in6_update_ifa1(struct ifnet *ifp, struc
 			if (error)
 				goto cleanup;
 		} else {
-			RTFREE(rt);
+			RTFREE(&rt);
 		}
 		imm = in6_joingroup(ifp, &mltaddr.sin6_addr, &error, 0);
 		if (!imm) {
@@ -1222,7 +1222,7 @@ in6_update_ifa1(struct ifnet *ifp, struc
 			if (memcmp(&mltaddr.sin6_addr,
 			    &satocsin6(rt_getkey(rt))->sin6_addr,
 			    32 / NBBY)) {
-				RTFREE(rt);
+				RTFREE(&rt);
 				rt = NULL;
 			} else if (rt->rt_ifp != ifp) {
 				IN6_DPRINTF("%s: rt_ifp %p -> %p (%s) "
@@ -1253,7 +1253,7 @@ in6_update_ifa1(struct ifnet *ifp, struc
 				goto cleanup;
 #undef	MLTMASK_LEN
 		} else {
-			RTFREE(rt);
+			RTFREE(&rt);
 		}
 		imm = in6_joingroup(ifp, &mltaddr.sin6_addr, &error, 0);
 		if (!imm) {
Index: netinet6/in6_gif.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/in6_gif.c,v
retrieving revision 1.58
diff -u -p -r1.58 in6_gif.c
--- netinet6/in6_gif.c	14 Mar 2009 14:46:10 -0000	1.58
+++ netinet6/in6_gif.c	28 Apr 2009 13:06:02 -0000
@@ -329,10 +329,10 @@ gif_validate6(const struct ip6_hdr *ip6,
 			    ip6_sprintf(&u.sin6.sin6_addr));
 #endif
 			if (rt != NULL)
-				rtfree(rt);
+				rtfree(&rt);
 			return 0;
 		}
-		rtfree(rt);
+		rtfree(&rt);
 	}
 
 	return 128 * 2;
Index: netinet6/in6_ifattach.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/in6_ifattach.c,v
retrieving revision 1.81
diff -u -p -r1.81 in6_ifattach.c
--- netinet6/in6_ifattach.c	7 Nov 2008 00:20:18 -0000	1.81
+++ netinet6/in6_ifattach.c	28 Apr 2009 13:06:02 -0000
@@ -884,7 +884,7 @@ in6_ifdetach(struct ifnet *ifp)
 		if ((ia->ia_flags & IFA_ROUTE) &&
 		    (rt = rtalloc1((struct sockaddr *)&ia->ia_addr, 0))) {
 			rtflags = rt->rt_flags;
-			rtfree(rt);
+			rtfree(&rt);
 			rtrequest(RTM_DELETE, (struct sockaddr *)&ia->ia_addr,
 			    (struct sockaddr *)&ia->ia_addr,
 			    (struct sockaddr *)&ia->ia_prefixmask,
Index: netinet6/nd6.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/nd6.c,v
retrieving revision 1.131
diff -u -p -r1.131 nd6.c
--- netinet6/nd6.c	7 Nov 2008 00:20:18 -0000	1.131
+++ netinet6/nd6.c	28 Apr 2009 13:06:02 -0000
@@ -808,7 +808,7 @@ nd6_lookup(const struct in6_addr *addr6,
 		 * interface route.
 		 */
 		if (create) {
-			RTFREE(rt);
+			RTFREE(&rt);
 			rt = NULL;
 		}
 	}
@@ -1971,7 +1971,7 @@ nd6_output(struct ifnet *ifp, struct ifn
 			if (rt->rt_gwroute == NULL)
 				goto lookup;
 			if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
-				rtfree(rt); rt = rt0;
+				rtfree(&rt); rt = rt0;
 			lookup:
 				rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
 				if ((rt = rt->rt_gwroute) == NULL)
Index: netinet6/nd6_nbr.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/nd6_nbr.c,v
retrieving revision 1.94
diff -u -p -r1.94 nd6_nbr.c
--- netinet6/nd6_nbr.c	18 Apr 2009 14:58:05 -0000	1.94
+++ netinet6/nd6_nbr.c	28 Apr 2009 13:06:02 -0000
@@ -244,7 +244,7 @@ nd6_ns_input(struct mbuf *m, int off, in
 			}
 		}
 		if (rt)
-			rtfree(rt);
+			rtfree(&rt);
 	}
 	if (ifa == NULL) {
 		/*
Index: netinet6/nd6_rtr.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/nd6_rtr.c,v
retrieving revision 1.78
diff -u -p -r1.78 nd6_rtr.c
--- netinet6/nd6_rtr.c	18 Mar 2009 16:00:23 -0000	1.78
+++ netinet6/nd6_rtr.c	28 Apr 2009 13:06:02 -0000
@@ -559,7 +559,7 @@ defrouter_delreq(struct nd_defrouter *dr
 			 * rtrequest().
 			 */
 			oldrt->rt_refcnt++;
-			rtfree(oldrt);
+			rtfree(&oldrt);
 		}
 	}
 
@@ -1694,7 +1694,7 @@ nd6_prefix_offlink(struct nd_prefix *pr)
 		if (rt->rt_refcnt <= 0) {
 			/* XXX: we should free the entry ourselves. */
 			rt->rt_refcnt++;
-			rtfree(rt);
+			rtfree(&rt);
 		}
 	}