 @@ -1,14 +1,14 @@
-/*	$NetBSD: rtsock.c,v 1.251 2019/08/22 21:14:45 roy Exp $	*/
+/*	$NetBSD: rtsock.c,v 1.252 2019/09/01 18:54:38 roy Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -51,27 +51,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rtsock.c,v 1.251 2019/08/22 21:14:45 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rtsock.c,v 1.252 2019/09/01 18:54:38 roy Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
 #include "opt_compat_netbsd.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/proc.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/domain.h>
 #include <sys/protosw.h>
 @@ -142,41 +142,41 @@ if_addrflags(struct ifaddr *ifa)
 /*
  * Send a routing message as mimicing that a cloned route is added.
  */
 void
 rt_clonedmsg(int type, const struct sockaddr *dst, const uint8_t *lladdr,
     const struct ifnet *ifp)
+{
 	struct rt_addrinfo info;
 	/* Mimic flags exactly */
 #define RTF_LLINFO	0x400
 #define RTF_CLONED	0x2000
-	int flags = RTF_HOST | RTF_DONE | RTF_LLINFO | RTF_CLONED;
+	int flags = RTF_DONE;
 	union {
 		struct sockaddr sa;
 		struct sockaddr_storage ss;
 		struct sockaddr_dl sdl;
 	} u;
 	uint8_t namelen = strlen(ifp->if_xname);
 	uint8_t addrlen = ifp->if_addrlen;
-	if (type != RTM_DELETE)
+	if (type != RTM_MISS)
 		flags |= RTF_HOST | RTF_CLONED | RTF_LLINFO;
 	if (type == RTM_ADD || type == RTM_CHANGE)
 		flags |= RTF_UP;
 	memset(&info, 0, sizeof(info));
 	info.rti_info[RTAX_DST] = dst;
 	sockaddr_dl_init(&u.sdl, sizeof(u.ss), ifp->if_index, ifp->if_type,
-	    NULL, namelen, lladdr, addrlen);
+	    NULL, 0, lladdr, ifp->if_addrlen);
 	info.rti_info[RTAX_GATEWAY] = &u.sa;
 	rt_missmsg(type, &info, flags, 0);
 #undef RTF_LLINFO
 #undef RTF_CLONED
+}
 /*
  * The remaining code implements the routing-table sysctl node.  It is
  * compiled only for the non-COMPAT case.
  */

 @@ -1,14 +1,14 @@
-/*	$NetBSD: nd6.c,v 1.261 2019/08/31 01:49:45 roy Exp $	*/
+/*	$NetBSD: nd6.c,v 1.262 2019/09/01 18:54:38 roy Exp $	*/
 /*	$KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,27 +21,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.261 2019/08/31 01:49:45 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.262 2019/09/01 18:54:38 roy Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_net_mpsafe.h"
 #endif
 #include "bridge.h"
 #include "carp.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
 #include <sys/kmem.h>
 #include <sys/mbuf.h>
 @@ -451,71 +451,76 @@ nd6_llinfo_get_holdsrc(struct llentry *l
 		src = NULL;
 	return src;
+}
 static void
 nd6_llinfo_timer(void *arg)
+{
 	struct llentry *ln = arg;
 	struct ifnet *ifp;
 	struct nd_ifinfo *ndi = NULL;
 	bool send_ns = false;
 	const struct in6_addr *daddr6 = NULL;
 	const struct in6_addr *taddr6 = &ln->r_l3addr.addr6;
 	struct sockaddr_in6 sin6;
 	SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
 	LLE_WLOCK(ln);
 	if ((ln->la_flags & LLE_LINKED) == 0)
 		goto out;
 	if (ln->ln_ntick > 0) {
 		nd6_llinfo_settimer(ln, ln->ln_ntick);
 		goto out;
+	}
 	ifp = ln->lle_tbl->llt_ifp;
 	KASSERT(ifp != NULL);
 	ndi = ND_IFINFO(ifp);
 	switch (ln->ln_state) {
 	case ND6_LLINFO_INCOMPLETE:
 		if (ln->ln_asked < nd6_mmaxtries) {
 			ln->ln_asked++;
 			send_ns = true;
-		} else {
+			break;
 			struct mbuf *m = ln->ln_hold;
 			if (m) {
 				struct mbuf *m0;
-				/*
+		if (ln->ln_hold) {
-				 * assuming every packet in ln_hold has
+			struct mbuf *m = ln->ln_hold, *m0;
 				 * the same IP header
-				 */
+			/*
-				m0 = m->m_nextpkt;
+			 * assuming every packet in ln_hold has
-				m->m_nextpkt = NULL;
+			 * the same IP header
-				ln->ln_hold = m0;
+			 */
-				clear_llinfo_pqueue(ln);
+			m0 = m->m_nextpkt;
 			m->m_nextpkt = NULL;
-			LLE_REMREF(ln);
+			ln->ln_hold = m0;
-			nd6_free(ln, 0);
+			clear_llinfo_pqueue(ln);
 			ln = NULL;
-			if (m != NULL) {
+			icmp6_error2(m, ICMP6_DST_UNREACH,
-				icmp6_error2(m, ICMP6_DST_UNREACH,
+			    ICMP6_DST_UNREACH_ADDR, 0, ifp);
 				    ICMP6_DST_UNREACH_ADDR, 0, ifp);
+		}
 		sockaddr_in6_init(&sin6, taddr6, 0, 0, 0);
 		rt_clonedmsg(RTM_MISS, sin6tosa(&sin6), NULL, ifp);
 		LLE_REMREF(ln);
 		nd6_free(ln, 0);
 		ln = NULL;
 		break;
 	case ND6_LLINFO_REACHABLE:
 		if (!ND6_LLINFO_PERMANENT(ln)) {
 			ln->ln_state = ND6_LLINFO_STALE;
 			nd6_llinfo_settimer(ln, nd6_gctimer * hz);
+		}
 		break;
 	case ND6_LLINFO_PURGE:
 	case ND6_LLINFO_STALE:
 		/* Garbage Collection(RFC 2461 5.3) */
 		if (!ND6_LLINFO_PERMANENT(ln)) {
 			LLE_REMREF(ln);
 			nd6_free(ln, 1);
 @@ -540,27 +545,26 @@ nd6_llinfo_timer(void *arg)
 			ln->ln_asked++;
 			daddr6 = &ln->r_l3addr.addr6;
 			send_ns = true;
 		} else {
 			LLE_REMREF(ln);
 			nd6_free(ln, 0);
 			ln = NULL;
+		}
 		break;
+	}
 	if (send_ns) {
 		struct in6_addr src, *psrc;
 		const struct in6_addr *taddr6 = &ln->r_l3addr.addr6;
 		nd6_llinfo_settimer(ln, ndi->retrans * hz / 1000);
 		psrc = nd6_llinfo_get_holdsrc(ln, &src);
 		LLE_FREE_LOCKED(ln);
 		ln = NULL;
 		nd6_ns_output(ifp, daddr6, taddr6, psrc, NULL);
+	}
 out:
 	if (ln != NULL)
 		LLE_FREE_LOCKED(ln);
 	SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
+}
 @@ -1181,28 +1185,26 @@ nd6_is_addr_neighbor(const struct sockad
+}
 /*
  * Free an nd6 llinfo entry.
  * Since the function would cause significant changes in the kernel, DO NOT
  * make it global, unless you have a strong reason for the change, and are sure
  * that the change is safe.
  */
 static void
 nd6_free(struct llentry *ln, int gc)
+{
 	struct ifnet *ifp;
 	struct in6_addr *in6;
 	struct sockaddr_in6 sin6;
 	const char *lladdr;
 	KASSERT(ln != NULL);
 	LLE_WLOCK_ASSERT(ln);
 	ifp = ln->lle_tbl->llt_ifp;
 	in6 = &ln->r_l3addr.addr6;
 	/*
 	 * we used to have pfctlinput(PRC_HOSTDEAD) here.
 	 * even though it is not harmful, it was not really necessary.
 	 */
 	if (!ip6_forwarding && ln->ln_router) {
 		if (ln->ln_state == ND6_LLINFO_STALE && gc) {
 @@ -1272,29 +1274,35 @@ nd6_free(struct llentry *ln, int gc)
 #ifdef __FreeBSD__
 		/*
 		 * If this entry was added by an on-link redirect, remove the
 		 * corresponding host route.
 		 */
 		if (ln->la_flags & LLE_REDIRECT)
 			nd6_free_redirect(ln);
 #endif
 		ND6_UNLOCK();
 		LLE_WLOCK(ln);
+	}
-	sockaddr_in6_init(&sin6, in6, 0, 0, 0);
+	if (ln->la_flags & LLE_VALID || gc) {
-	lladdr = ln->la_flags & LLE_VALID ? (const char *)&ln->ll_addr : NULL;
+		struct sockaddr_in6 sin6;
-	rt_clonedmsg(RTM_DELETE, sin6tosa(&sin6), lladdr, ifp);
+		const char *lladdr;
 		sockaddr_in6_init(&sin6, in6, 0, 0, 0);
 		lladdr = ln->la_flags & LLE_VALID ?
 		    (const char *)&ln->ll_addr : NULL;
 		rt_clonedmsg(RTM_DELETE, sin6tosa(&sin6), lladdr, ifp);
+	}
 	/*
 	 * Save to unlock. We still hold an extra reference and will not
 	 * free(9) in llentry_free() if someone else holds one as well.
 	 */
 	LLE_WUNLOCK(ln);
 	IF_AFDATA_LOCK(ifp);
 	LLE_WLOCK(ln);
 	lltable_free_entry(LLTABLE6(ifp), ln);
 	IF_AFDATA_UNLOCK(ifp);
+}
 @@ -2208,27 +2216,27 @@ nd6_cache_lladdr(
 		ln->ln_router = 0;
 		break;
 	case ND_ROUTER_ADVERT:
 		/*
 		 * Mark an entry with lladdr as a router.
 		 */
 		if ((!is_newentry && (olladdr || lladdr)) ||	/* (2-5) */
 		    (is_newentry && lladdr)) {			/* (7) */
 			ln->ln_router = 1;
+		}
 		break;
+	}
-	if (do_update) {
+	if (do_update && lladdr != NULL) {
 		struct sockaddr_in6 sin6;
 		sockaddr_in6_init(&sin6, from, 0, 0, 0);
 		rt_clonedmsg(is_newentry ? RTM_ADD : RTM_CHANGE,
 		    sin6tosa(&sin6), lladdr, ifp);
+	}
 	if (ln != NULL) {
 		router = ln->ln_router;
 		LLE_WUNLOCK(ln);
+	}
 	/*
 @@ -2324,47 +2332,41 @@ nd6_resolve(struct ifnet *ifp, const str
 	if (ln != NULL && (ln->la_flags & LLE_VALID) != 0 &&
 	    ln->ln_state == ND6_LLINFO_REACHABLE) {
 		/* Fast path */
 		memcpy(lldst, &ln->ll_addr, MIN(dstsize, ifp->if_addrlen));
 		LLE_RUNLOCK(ln);
 		return 0;
+	}
 	if (ln != NULL)
 		LLE_RUNLOCK(ln);
 	/* Slow path */
 	ln = nd6_lookup(&dst->sin6_addr, ifp, true);
 	if (ln == NULL && nd6_is_addr_neighbor(dst, ifp))  {
 		struct sockaddr_in6 sin6;
 		/*
 		 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
 		 * the condition below is not very efficient.  But we believe
 		 * it is tolerable, because this should be a rare case.
 		 */
 		ln = nd6_create(&dst->sin6_addr, ifp);
 		if (ln == NULL) {
 			char ip6buf[INET6_ADDRSTRLEN];
 			log(LOG_DEBUG,
 			    "%s: can't allocate llinfo for %s "
 			    "(ln=%p, rt=%p)\n", __func__,
 			    IN6_PRINT(ip6buf, &dst->sin6_addr), ln, rt);
 			m_freem(m);
 			return ENOBUFS;
+		}
 		sockaddr_in6_init(&sin6, &ln->r_l3addr.addr6, 0, 0, 0);
 		if (rt != NULL)
 			rt_clonedmsg(RTM_ADD, sin6tosa(&sin6), NULL, ifp);
 		created = true;
+	}
 	if (ln == NULL) {
 		m_freem(m);
 		return ENETDOWN; /* better error? */
+	}
 	LLE_WLOCK_ASSERT(ln);
 	/* We don't have to do link-layer address resolution on a p2p link. */
 	if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
 	    ln->ln_state < ND6_LLINFO_REACHABLE) {
 @@ -2429,32 +2431,29 @@ nd6_resolve(struct ifnet *ifp, const str
+	}
 	/*
 	 * If there has been no NS for the neighbor after entering the
 	 * INCOMPLETE state, send the first solicitation.
 	 */
 	if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) {
 		struct in6_addr src, *psrc;
 		ln->ln_asked++;
 		nd6_llinfo_settimer(ln, ND_IFINFO(ifp)->retrans * hz / 1000);
 		psrc = nd6_llinfo_get_holdsrc(ln, &src);
 		LLE_WUNLOCK(ln);
 		ln = NULL;
 		nd6_ns_output(ifp, NULL, &dst->sin6_addr, psrc, NULL);
-	} else {
+	} else
 		/* We did the lookup so we need to do the unlock here. */
 		LLE_WUNLOCK(ln);
 	if (created)
 		nd6_gc_neighbors(LLTABLE6(ifp), &dst->sin6_addr);
 	return EWOULDBLOCK;
+}
 int
 nd6_need_cache(struct ifnet *ifp)
+{
 	/*
 	 * XXX: we currently do not make neighbor cache on any interface
 	 * other than ARCnet, Ethernet, FDDI and GIF.

 @@ -1,14 +1,14 @@
-/*	$NetBSD: nd6_nbr.c,v 1.171 2019/08/30 08:40:25 roy Exp $	*/
+/*	$NetBSD: nd6_nbr.c,v 1.172 2019/09/01 18:54:38 roy Exp $	*/
 /*	$KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,27 +21,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.171 2019/08/30 08:40:25 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.172 2019/09/01 18:54:38 roy Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
 #include "opt_net_mpsafe.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kmem.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sockio.h>
 @@ -595,33 +595,33 @@ nd6_ns_output(struct ifnet *ifp, const s
 void
 nd6_na_input(struct mbuf *m, int off, int icmp6len)
+{
 	struct ifnet *ifp;
 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 	struct nd_neighbor_advert *nd_na;
 	struct in6_addr saddr6 = ip6->ip6_src;
 	struct in6_addr daddr6 = ip6->ip6_dst;
 	struct in6_addr taddr6;
 	int flags;
 	int is_router;
 	int is_solicited;
 	int is_override;
 	int rt_cmd;
 	char *lladdr = NULL;
 	int lladdrlen = 0;
 	struct ifaddr *ifa;
 	struct llentry *ln = NULL;
 	union nd_opts ndopts;
 	struct sockaddr_in6 ssin6;
 	bool rt_announce;
 	bool checklink = false;
 	struct psref psref;
 	struct psref psref_ia;
 	char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN];
 	ifp = m_get_rcvif_psref(m, &psref);
 	if (ifp == NULL)
 		goto freeit;
 	if (ip6->ip6_hlim != 255) {
 		nd6log(LOG_ERR,
 		    "invalid hlim (%d) from %s to %s on %s\n",
 		    ip6->ip6_hlim, IN6_PRINT(ip6buf, &ip6->ip6_src),
 @@ -725,41 +725,41 @@ nd6_na_input(struct mbuf *m, int off, in
 		nd6log(LOG_INFO, "ND packet from non-neighbor %s on %s\n",
 		    IN6_PRINT(ip6buf, &saddr6), if_name(ifp));
 		goto bad;
+	}
 	/*
 	 * If no neighbor cache entry is found, NA SHOULD silently be
 	 * discarded.
 	 */
 	ln = nd6_lookup(&taddr6, ifp, true);
 	if (ln == NULL)
 		goto freeit;
-	rt_announce = false;
+	rt_cmd = 0;
 	if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
 		/*
 		 * If the link-layer has address, and no lladdr option came,
 		 * discard the packet.
 		 */
 		if (ifp->if_addrlen && !lladdr)
 			goto freeit;
 		/*
 		 * Record link-layer address, and update the state.
 		 */
 		memcpy(&ln->ll_addr, lladdr, ifp->if_addrlen);
 		ln->la_flags |= LLE_VALID;
-		rt_announce = true;
+		rt_cmd = RTM_ADD;
 		if (is_solicited) {
 			ln->ln_state = ND6_LLINFO_REACHABLE;
 			ln->ln_byhint = 0;
 			if (!ND6_LLINFO_PERMANENT(ln)) {
 				nd6_llinfo_settimer(ln,
 				    ND_IFINFO(ln->lle_tbl->llt_ifp)->reachable * hz);
+			}
 		} else {
 			ln->ln_state = ND6_LLINFO_STALE;
 			nd6_llinfo_settimer(ln, nd6_gctimer * hz);
+		}
 		if ((ln->ln_router = is_router) != 0) {
 			/*
 @@ -770,32 +770,34 @@ nd6_na_input(struct mbuf *m, int off, in
 			checklink = true;
+		}
 	} else {
 		bool llchange;
 		/*
 		 * Check if the link-layer address has changed or not.
 		 */
 		if (lladdr == NULL)
 			llchange = false;
 		else {
 			if (ln->la_flags & LLE_VALID) {
 				if (memcmp(lladdr, &ln->ll_addr, ifp->if_addrlen))
-					llchange = rt_announce = true;
+					llchange = true;
 				else
 					llchange = false;
 			} else
-				llchange = rt_announce = true;
+				llchange = true;
+		}
 		if (llchange)
 			rt_cmd = RTM_CHANGE;
 		/*
 		 * This is VERY complex.  Look at it with care.
+		 *
 		 * override solicit lladdr llchange	action
 		 *					(L: record lladdr)
+		 *
 		 *	0	0	n	--	(2c)
 		 *	0	0	y	n	(2b) L
 		 *	0	0	y	y	(1)    REACHABLE->STALE
 		 *	0	1	n	--	(2c)   *->REACHABLE
 		 *	0	1	y	n	(2b) L *->REACHABLE
 		 *	0	1	y	y	(1)    REACHABLE->STALE
 @@ -872,31 +874,31 @@ nd6_na_input(struct mbuf *m, int off, in
 				nd6_rt_flush(&ip6->ip6_src, ln->lle_tbl->llt_ifp);
+			}
 			ND6_UNLOCK();
+		}
 		ln->ln_router = is_router;
+	}
         /*
 	 * XXX: does this matter?
 	 * rt->rt_flags &= ~RTF_REJECT;
 	 */
 	ln->ln_asked = 0;
 	nd6_llinfo_release_pkts(ln, ifp);
-	if (rt_announce) {
+	if (rt_cmd != 0) {
 		struct sockaddr_in6 sin6;
 		sockaddr_in6_init(&sin6, &ln->r_l3addr.addr6, 0, 0, 0);
-		rt_clonedmsg(RTM_CHANGE, sin6tosa(&sin6),
+		rt_clonedmsg(rt_cmd, sin6tosa(&sin6),
 		    (char *)&ln->ll_addr, ln->lle_tbl->llt_ifp);
+	}
  freeit:
 	if (ln != NULL)
 		LLE_WUNLOCK(ln);
 	if (checklink) {
 		ND6_WLOCK();
 		nd6_pfxlist_onlink_check();
 		ND6_UNLOCK();
+	}