commit 0d7f7d8d3aae21d9686634d7ff03c259ecc359b1
Author: Ryota Ozaki <ozaki-r@iij.ad.jp>
Date:   Wed Sep 2 09:47:02 2015 +0900

    Don't call arptfree when la_rt is NULL

diff --git a/sys/netinet/if_arp.c b/sys/netinet/if_arp.c
index f6ac781..3bba626 100644
--- a/sys/netinet/if_arp.c
+++ b/sys/netinet/if_arp.c
@@ -159,7 +159,7 @@ static	void arp_init(void);
 
 static	struct sockaddr *arp_setgate(struct rtentry *, struct sockaddr *,
 	    const struct sockaddr *);
-static	void arptfree(struct llentry *);
+static	void arptfree(struct rtentry *);
 static	void arptimer(void *);
 static	struct llentry *arplookup(struct ifnet *, struct mbuf *,
 	    const struct in_addr *, int, int, int, struct rtentry *);
@@ -354,8 +354,11 @@ arptimer(void *arg)
 	/* XXX: LOR avoidance. We still have ref on lle. */
 	LLE_WUNLOCK(lle);
 
-	/* We have to call this w/o lock */
-	arptfree(lle);
+	/* We have to call this w/o IF_AFDATA_LOCK */
+	if (lle->la_rt != NULL) {
+		arptfree(lle->la_rt);
+		lle->la_rt = NULL;
+	}
 
 	IF_AFDATA_LOCK(ifp);
 	LLE_WLOCK(lle);
@@ -1445,18 +1448,11 @@ out:
 /*
  * Free an arp entry.
  */
-static void arptfree(struct llentry *la)
+static void arptfree(struct rtentry *rt)
 {
-	struct rtentry *rt = la->la_rt;
-
-	KASSERT(rt != NULL);
-
-	if (la->la_rt != NULL) {
-		rtfree(la->la_rt);
-		la->la_rt = NULL;
-	}
 
 	rtrequest(RTM_DELETE, rt_getkey(rt), NULL, rt_mask(rt), 0, NULL);
+	rtfree(rt);
 }
 
 /*