If the interface is gone that means you're dealing with a cached route so there's no need to try to remove it from the table.
Better be explicit and do that before calling rtdeletemsg() rather than inside. ok? Index: netinet/ip_icmp.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_icmp.c,v retrieving revision 1.150 diff -u -p -r1.150 ip_icmp.c --- netinet/ip_icmp.c 3 Dec 2015 21:11:53 -0000 1.150 +++ netinet/ip_icmp.c 7 Dec 2015 12:40:06 -0000 @@ -1042,19 +1042,21 @@ icmp_mtudisc(struct icmp *icp, u_int rta void icmp_mtudisc_timeout(struct rtentry *rt, struct rttimer *r) { - if (rt == NULL) - panic("icmp_mtudisc_timeout: bad route to timeout"); + struct ifnet *ifp; + int s; - if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) == - (RTF_DYNAMIC | RTF_HOST)) { + ifp = if_get(rt->rt_ifidx); + if (ifp == NULL) + return; + + if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { void *(*ctlfunc)(int, struct sockaddr *, u_int, void *); struct sockaddr_in sin; - int s; sin = *satosin(rt_key(rt)); s = splsoftnet(); - rtdeletemsg(rt, NULL, r->rtt_tableid); + rtdeletemsg(rt, ifp, r->rtt_tableid); /* Notify TCP layer of increased Path MTU estimate */ ctlfunc = inetsw[ip_protox[IPPROTO_TCP]].pr_ctlinput; @@ -1062,9 +1064,12 @@ icmp_mtudisc_timeout(struct rtentry *rt, (*ctlfunc)(PRC_MTUINC, sintosa(&sin), r->rtt_tableid, NULL); splx(s); - } else + } else { if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) rt->rt_rmx.rmx_mtu = 0; + } + + if_put(ifp); } /* @@ -1088,17 +1093,20 @@ icmp_ratelimit(const struct in_addr *dst void icmp_redirect_timeout(struct rtentry *rt, struct rttimer *r) { - if (rt == NULL) - panic("icmp_redirect_timeout: bad route to timeout"); + struct ifnet *ifp; + int s; - if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) == - (RTF_DYNAMIC | RTF_HOST)) { - int s; + ifp = if_get(rt->rt_ifidx); + if (ifp == NULL) + return; + if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { s = splsoftnet(); - rtdeletemsg(rt, NULL, r->rtt_tableid); + rtdeletemsg(rt, ifp, r->rtt_tableid); splx(s); } + + if_put(ifp); } int Index: netinet6/icmp6.c =================================================================== RCS file: /cvs/src/sys/netinet6/icmp6.c,v retrieving revision 1.182 diff -u -p -r1.182 icmp6.c --- netinet6/icmp6.c 3 Dec 2015 21:11:53 -0000 1.182 +++ netinet6/icmp6.c 7 Dec 2015 12:39:28 -0000 @@ -1952,34 +1952,42 @@ icmp6_mtudisc_clone(struct sockaddr *dst void icmp6_mtudisc_timeout(struct rtentry *rt, struct rttimer *r) { - if (rt == NULL) - panic("icmp6_mtudisc_timeout: bad route to timeout"); - if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) == - (RTF_DYNAMIC | RTF_HOST)) { - int s; + struct ifnet *ifp; + int s; + ifp = if_get(rt->rt_ifidx); + if (ifp == NULL) + return; + + if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { s = splsoftnet(); - rtdeletemsg(rt, NULL, r->rtt_tableid); + rtdeletemsg(rt, ifp, r->rtt_tableid); splx(s); } else { if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) rt->rt_rmx.rmx_mtu = 0; } + + if_put(ifp); } void icmp6_redirect_timeout(struct rtentry *rt, struct rttimer *r) { - if (rt == NULL) - panic("icmp6_redirect_timeout: bad route to timeout"); - if ((rt->rt_flags & (RTF_GATEWAY | RTF_DYNAMIC | RTF_HOST)) == - (RTF_GATEWAY | RTF_DYNAMIC | RTF_HOST)) { - int s; + struct ifnet *ifp; + int s; + ifp = if_get(rt->rt_ifidx); + if (ifp == NULL) + return; + + if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) { s = splsoftnet(); - rtdeletemsg(rt, NULL, r->rtt_tableid); + rtdeletemsg(rt, ifp, r->rtt_tableid); splx(s); } + + if_put(ifp); } int *icmpv6ctl_vars[ICMPV6CTL_MAXID] = ICMPV6CTL_VARS;