There's no way to have a negative number of addresses configured on a carp(4) interface.
This hack might have been required in the past when the SIOCDIFADDR handler was doing "sc->sc_naddrs--" but it is definitively dead code now. Ok to kill it? Index: netinet/ip_carp.c =================================================================== RCS file: /home/ncvs/src/sys/netinet/ip_carp.c,v retrieving revision 1.229 diff -u -p -r1.229 ip_carp.c --- netinet/ip_carp.c 30 Apr 2014 10:04:33 -0000 1.229 +++ netinet/ip_carp.c 26 Jun 2014 09:48:01 -0000 @@ -1697,24 +1697,6 @@ carp_set_ifp(struct carp_softc *sc, stru if (sc->sc_carpdev != NULL) carpdetach(sc); - /* join multicast groups */ - if (sc->sc_naddrs < 0 && - (error = carp_join_multicast(sc)) != 0) { - if (ncif != NULL) - free(ncif, M_IFADDR); - return (error); - } - -#ifdef INET6 - if (sc->sc_naddrs6 < 0 && - (error = carp_join_multicast6(sc)) != 0) { - if (ncif != NULL) - free(ncif, M_IFADDR); - carp_multicast_cleanup(sc); - return (error); - } -#endif - /* attach carp interface to physical interface */ if (ncif != NULL) ifp->if_carp = (caddr_t)ncif;