The following reply was made to PR kern/35273; it has been noted by GNATS.

From: Julian Coleman <jdc@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35273 CVS commit: [netbsd-4] src/sys/netinet
Date: Wed, 28 Mar 2007 20:46:14 +0000 (UTC)

 Module Name:	src
 Committed By:	jdc
 Date:		Wed Mar 28 20:46:14 UTC 2007
 
 Modified Files:
 	src/sys/netinet [netbsd-4]: ip_output.c
 
 Log Message:
 Pull up revision 1.174 (requested by joerg in ticket #524).
 
 Unconditionally zero and free iproute. Before IPsec tunnel packets e.g.
 from ICMP could end up in leaking the reference in iproute, as
 ipsec4_output would overwrite the ro pointer in state.
 
 Tested by Juraj Hercek and supposed to fix PR kern/35273 and kern/35318.
 
 
 To generate a diff of this commit:
 cvs rdiff -r1.167.2.1 -r1.167.2.2 src/sys/netinet/ip_output.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.