kern/50704: Flushing routing table causes kernel panic

[venture37%geeklan.co.uk@localhost]

>Number:         50704
>Category:       kern
>Synopsis:       Flushing routing table causes kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 25 00:15:00 +0000 2016
>Originator:     Sevan Janiyan
>Release:        NetBSD  7.99.25
>Organization:
>Environment:
NetBSD  7.99.25 NetBSD 7.99.25 (GENERIC.201601241850Z) #0: Sun Jan 24 19:45:03 UTC 2016  builds%b45.netbsd.org@localhost:/home/builds/ab/HEAD/amd64/201601241850Z-obj/home/source/ab/HEAD/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
I'm trying to get networking setup in a scenario where the gateway is in another subnet on  a virtual machine.

NetBSD is a bhyve guest.
Following http://www.netbsd.org/docs/network/#nonsubnetgateway I've not had much success, retrying various things, I flush the routing table in between to start with a fresh slate.
It seems that it's possible to trigger a kernel panic whilst doing this.
panic: kernel diagnostic assertion "(lle)->lle_refcnt > 0" failed: file "/home/source/ab/HEAD/src/sys/net/if_llatbl.c", line 305 bogus refcnt 0 on lle 0xfffffe801f9e7dc8

I have a core dump of the kernel but VM is without network, can make the effort to extract it, if required.

Whilst booted from the install media
panic: kernel diagnostic assertion "(lle)->lle_refcnt > 0" failed: file "/home/source/ab/HEAD/src/sys/net/if_llatbl.c", line 305 bogus refcnt 0 on lle 0xfffffe801fb3e648
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80114b25 cs 8 rflags 246 cr2 7f7ff7b01020 ilevel 4 rsp fffffe800257ca30
curlwp 0xfffffe801f697560 pid 45.1 lowest kstack 0xfffffe80025792c0
Stopped in pid 45.1 (route) at  netbsd:breakpoint+0x5:  leave

breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x13c
kern_assert() at netbsd:kern_assert+0x4f
llentry_free() at netbsd:llentry_free+0x128
arp_rtrequest() at netbsd:arp_rtrequest+0x598
rtrequest1() at netbsd:rtrequest1+0x3a9
route_output() at netbsd:route_output+0x4f8
route_send_wrapper() at netbsd:route_send_wrapper+0x68
sosend() at netbsd:sosend+0x712
soo_write() at netbsd:soo_write+0x2c
dofilewrite() at netbsd:dofilewrite+0x97
sys_write() at netbsd:sys_write+0x5f
syscall() at netbsd:syscall+0xbe
--- syscall (number 4) ---
7f7ff743cb7a:


db{0}> ps
PID    LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
45   >   1 7   0         0   fffffe801f697560              route
19       1 3   0        80   fffffe801f697980                ksh pause
18       1 3   0        80   fffffe801fa35120                 sh wait
17       1 3   0        80   fffffe801fa35540                 sh wait
16       1 3   0        80   fffffe801fa35960            sysinst wait
12       1 3   0        80   fffffe80024dc900                 sh wait
1        1 3   0        80   fffffe80024bd0e0               init wait
0       36 3   0       200   fffffe80024c6100           aiodoned aiodoned
0       35 3   0       200   fffffe80024dc4e0            ioflush syncer
0       34 3   0       200   fffffe80024dc0c0           pgdaemon pgdaemon
0       33 5   0       200   fffffe80024bd920           (zombie)
0       31 3   0       200   fffffe80024bd500          atapibus0 sccomp
0       29 3   0       200   fffffe80024c6940              unpgc unpgc
0       28 3   0       200   fffffe80024c6520        vmem_rehash vmem_rehash
0       19 3   0       200   fffffe801fd030a0            atabus0 atath
0       18 3   0       200   fffffe801fd034c0           lnxsyswq lnxsyswq
0       17 3   0       200   fffffe801fd038e0          cryptoret crypto_w
0       16 3   0       200   fffffe801fd00080             sysmon smtaskq
0       15 3   0       200   fffffe801fd004a0         pmfsuspend pmfsuspend
0       14 3   0       200   fffffe801fd008c0           pmfevent pmfevent
0       13 3   0       200   fffffe801fdda060         sopendfree sopendfr
0       12 3   0       200   fffffe801fdda480           nfssilly nfssilly
0       11 3   0       200   fffffe801fdda8a0            cachegc cachegc
0       10 3   0       200   fffffe801fea5040              vrele vrele
0        9 3   0       200   fffffe801fea5460             vdrain vdrain
0        8 3   0       200   fffffe801fea5880          modunload mod_unld
0        7 3   0       200   fffffe801feb3020            xcall/0 xcall
0        6 1   0       200   fffffe801feb3440          softser/0
0        5 1   0       200   fffffe801feb3860          softclk/0
0        4 1   0       200   fffffe801feb6000          softbio/0
0        3 1   0       200   fffffe801feb6420          softnet/0
0        2 1   0       201   fffffe801feb6840             idle/0
0        1 3   0       200   ffffffff81119720            swapper uvm
>How-To-Repeat:
flush routing table with "route flush"
>Fix: