kern/50161: IPv6 DHCP environment is unstable (panic)

[ryoon%NetBSD.org@localhost]

>Number:         50161
>Category:       kern
>Synopsis:       IPv6 DHCP environment is unstable (panic)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 22 11:10:00 +0000 2015
>Originator:     Ryo ONODERA
>Release:        NetBSD 7.99.21
>Organization:
	
>Environment:
	
	
System: NetBSD angelcake.elements.tetera.org 7.99.21 NetBSD 7.99.21 (DTRACE7) #116: Fri Aug 21 00:04:15 JST 2015 ryo_on%angelcake.elements.tetera.org@localhost:/usr/world/7.99/amd64/obj/sys/arch/amd64/compile/DTRACE7 amd64
Architecture: x86_64
Machine: amd64
>Description:
On IPv6 with DHCP environment, I have gotten endless
vmx0: removing route to 2400:402e:a337:8700::/64
vmx0: adding route to 2400:402e:a337:870

And finally have gotten panic.
Aug 19 21:20:38 carrotcake /netbsd: panic: kernel diagnostic assertion "rt->rt_refcnt > 0" failed: file "/mnt/nfs/src-current/src/sys/net/route.c", line 417 
Aug 19 21:20:38 carrotcake /netbsd: cpu0: Begin traceback...
Aug 19 21:20:38 carrotcake /netbsd: vpanic() at netbsd:vpanic+0x13c
Aug 19 21:20:38 carrotcake /netbsd: kern_assert() at netbsd:kern_assert+0x4f
Aug 19 21:20:38 carrotcake /netbsd: rtfree() at netbsd:rtfree+0xf5
Aug 19 21:20:38 carrotcake /netbsd: rtcache_clear() at netbsd:rtcache_clear+0x41
Aug 19 21:20:38 carrotcake /netbsd: rtcache_update() at netbsd:rtcache_update+0x12
Aug 19 21:20:38 carrotcake /netbsd: in6_pcbrtentry() at netbsd:in6_pcbrtentry+0xa4
Aug 19 21:20:38 carrotcake /netbsd: tcp_mss_from_peer() at netbsd:tcp_mss_from_peer+0x50
Aug 19 21:20:38 carrotcake /netbsd: tcp_input() at netbsd:tcp_input+0xc3b
Aug 19 21:20:38 carrotcake /netbsd: tcp6_input() at netbsd:tcp6_input+0x49
Aug 19 21:20:38 carrotcake /netbsd: ip6_input() at netbsd:ip6_input+0x561
Aug 19 21:20:38 carrotcake /netbsd: ip6intr() at netbsd:ip6intr+0x45
Aug 19 21:20:38 carrotcake /netbsd: softint_dispatch() at netbsd:softint_dispatch+0xd3
Aug 19 21:20:38 carrotcake /netbsd: DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe811d2bbff0
Aug 19 21:20:38 carrotcake /netbsd: Xsoftintr() at netbsd:Xsoftintr+0x4f
Aug 19 21:20:38 carrotcake /netbsd: --- interrupt ---
Aug 19 21:20:38 carrotcake /netbsd: 0:
Aug 19 21:20:38 carrotcake /netbsd: cpu0: End traceback...
Aug 19 21:20:38 carrotcake /netbsd: 
Aug 19 21:20:38 carrotcake /netbsd: dumping to dev 4,1 (offset=6256, size=4194191):
Aug 19 21:20:38 carrotcake /netbsd: dump WARNING: negative runtime; monotonic clock has gone backwards
Aug 19 21:20:38 carrotcake /netbsd: succeeded
Aug 19 21:20:38 carrotcake /netbsd: 
Aug 19 21:20:38 carrotcake /netbsd: 
Aug 19 21:20:38 carrotcake /netbsd: rebooting...

This is vmx(4) example, however I have same problem with axe(4).

0::/64
>How-To-Repeat:
	
Use IPv6 with DHCP on NetBSD/amd64 current.
>Fix:
	
I have no idea.

>Unformatted: