From c1d0ee19c5e3cf81f0f675654def6ad908073aec Mon Sep 17 00:00:00 2001
From: mpi <mpi@openbsd.org>
Date: Tue, 19 Jul 2016 14:49:46 +0000
Subject: [PATCH] NULLify a route pointer after calling rtfree(9).

This should theoretically be a no-op because we're freeing the PCB
right after, but it helps us debug a reference count problem found
by otto@.

ok mikeb@
---
 sys/netinet/in_pcb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index a1ad89bb637..2e47cb7e1a1 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.c,v 1.209 2016/07/05 09:17:10 mpi Exp $	*/
+/*	$OpenBSD: in_pcb.c,v 1.210 2016/07/19 14:49:46 mpi Exp $	*/
 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
 
 /*
@@ -587,8 +587,10 @@ in_pcbdetach(struct inpcb *inp)
 	so->so_pcb = 0;
 	sofree(so);
 	m_freem(inp->inp_options);
-	if (inp->inp_route.ro_rt)
+	if (inp->inp_route.ro_rt) {
 		rtfree(inp->inp_route.ro_rt);
+		inp->inp_route.ro_rt = NULL;
+	}
 #ifdef INET6
 	if (inp->inp_flags & INP_IPV6) {
 		ip6_freepcbopts(inp->inp_outputopts6);
-- 
2.20.1