On the train back from n2k16 I found the real cause of the hang reported by Dimitris Papastamos [0] and exposed by our recent changes to the routing table.
When an interface is removed/detached the kernel delete all the corresponding route entries. At this moment the interface is DOWN and the corresponding route as well. So the priority check should consider that. Without the diff attached or the workaround to stop iterating when an error occurs, the kernel would loop forever since it can't remove the RTF_BROADCAST entry. [0] https://marc.info/?l=openbsd-bugs&m=146909621511954&w=2 ok?
Index: net/route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.313 diff -u -p -r1.313 route.c --- net/route.c 22 Jul 2016 11:03:30 -0000 1.313 +++ net/route.c 8 Aug 2016 09:33:15 -0000 @@ -873,7 +873,7 @@ rtrequest_delete(struct rt_addrinfo *inf * kernel. */ if ((rt->rt_flags & (RTF_LOCAL|RTF_BROADCAST)) && - prio != RTP_LOCAL) { + (prio & RTP_MASK) != RTP_LOCAL) { rtfree(rt); return (EINVAL); }