The following reply was made to PR kern/35273; it has been noted by GNATS.

From: Manuel Bouyer <bouyer@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/35273 CVS commit: [netbsd-3] src/sys/netinet
Date: Sat, 31 Mar 2007 14:15:43 +0000 (UTC)

 Module Name:	src
 Committed By:	bouyer
 Date:		Sat Mar 31 14:15:43 UTC 2007
 
 Modified Files:
 	src/sys/netinet [netbsd-3]: ip_output.c
 
 Log Message:
 Pull up following revision(s) (requested by joerg in ticket #1734):
 	sys/netinet/ip_output.c: revision 1.167.2.2
 Unconditionally zero and free iproute. Before IPsec tunnel packets e.g.
 from ICMP could end up in leaking the reference in iproute, as
 ipsec4_output would overwrite the ro pointer in state.
 Tested by Juraj Hercek and supposed to fix PR kern/35273 and kern/35318.
 
 
 To generate a diff of this commit:
 cvs rdiff -r1.149.2.4 -r1.149.2.5 src/sys/netinet/ip_output.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.