Either because it has been specified in rt_ifa_add() or because rt_getifa() returns you the correct one. So if the key of a route matches an address on the ifp it *must* be the same ifa.
Let's make sure of that, ok? Index: net/if.c =================================================================== RCS file: /cvs/src/sys/net/if.c,v retrieving revision 1.390 diff -u -p -r1.390 if.c --- net/if.c 22 Oct 2015 10:46:26 -0000 1.390 +++ net/if.c 22 Oct 2015 11:06:11 -0000 @@ -1321,6 +1321,8 @@ p2p_rtrequest(int req, struct rtentry *r if (ifa == NULL) break; + KASSERT(ifa == rt->rt_ifa); + /* * XXX Since lo0 is in the default rdomain we should not * (ab)use it for any route related to an interface of a @@ -1335,17 +1337,6 @@ p2p_rtrequest(int req, struct rtentry *r break; rt->rt_flags &= ~RTF_LLINFO; - - /* - * make sure to set rt->rt_ifa to the interface - * address we are using, otherwise we will have trouble - * with source address selection. - */ - if (ifa != rt->rt_ifa) { - ifafree(rt->rt_ifa); - ifa->ifa_refcnt++; - rt->rt_ifa = ifa; - } break; case RTM_DELETE: case RTM_RESOLVE: Index: netinet/if_ether.c =================================================================== RCS file: /cvs/src/sys/netinet/if_ether.c,v retrieving revision 1.172 diff -u -p -r1.172 if_ether.c --- netinet/if_ether.c 13 Oct 2015 10:21:27 -0000 1.172 +++ netinet/if_ether.c 22 Oct 2015 11:06:13 -0000 @@ -235,17 +235,8 @@ arp_rtrequest(int req, struct rtentry *r break; } if (ifa) { + KASSERT(ifa == rt->rt_ifa); rt->rt_expire = 0; - /* - * make sure to set rt->rt_ifa to the interface - * address we are using, otherwise we will have trouble - * with source address selection. - */ - if (ifa != rt->rt_ifa) { - ifafree(rt->rt_ifa); - ifa->ifa_refcnt++; - rt->rt_ifa = ifa; - } } break; Index: netinet6/nd6.c =================================================================== RCS file: /cvs/src/sys/netinet6/nd6.c,v retrieving revision 1.156 diff -u -p -r1.156 nd6.c --- netinet6/nd6.c 22 Oct 2015 10:27:22 -0000 1.156 +++ netinet6/nd6.c 22 Oct 2015 11:06:15 -0000 @@ -1103,20 +1103,7 @@ nd6_rtrequest(int req, struct rtentry *r nd6_llinfo_settimer(ln, -1); ln->ln_state = ND6_LLINFO_REACHABLE; ln->ln_byhint = 0; - - /* - * Make sure rt_ifa be equal to the ifaddr - * corresponding to the address. - * We need this because when we refer - * rt_ifa->ia6_flags in ip6_input, we assume - * that the rt_ifa points to the address instead - * of the loopback address. - */ - if (ifa != rt->rt_ifa) { - ifafree(rt->rt_ifa); - ifa->ifa_refcnt++; - rt->rt_ifa = ifa; - } + KASSERT(ifa == rt->rt_ifa); } else if (rt->rt_flags & RTF_ANNOUNCE) { nd6_llinfo_settimer(ln, -1); ln->ln_state = ND6_LLINFO_REACHABLE;