kern/60721: Possible double freeing in npf routing

["joe%ns1.eloisystems.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60721
>Category:       kern
>Synopsis:       Possible double freeing in npf routing
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 12 09:40:00 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD current
>Organization:
NetBSD
>Environment:
NetBSD Joe 11.99.8 NetBSD 11.99.8 (GENERIC) #8: Sat Sep 12 08:16:35 UTC 202
>Description:
possible double freeing in npf routing if the IPv4 or IPv6 output path fails.

in both ip_output and ip6_output, the mbuf gets freed either in a success or failure path.

freeing the packet in failure path in npf route could lead to calling free on an mbuf twice.
>How-To-Repeat:
code inspection. Routing via 
>Fix:

if an error occurred on ip_output or ip6_output, 

set the mbuf (already freed) to NULL.

Index: src/sys/net/npf/npf_ext_route.c
===================================================================
RCS file: /cvsroot/src/sys/net/npf/npf_ext_route.c,v
retrieving revision 1.1
diff -u -r1.1 npf_ext_route.c
--- src/sys/net/npf/npf_ext_route.c	8 Apr 2026 00:33:07 -0000	1.1
+++ src/sys/net/npf/npf_ext_route.c	12 Sep 2026 09:30:12 -0000
@@ -364,6 +364,7 @@
 				error = ip6_if_output(ifp, ifp, m0, &dst.v6, NULL);
 
 			if (error) {
+				m0 = NULL;
 				goto bad;
 			}
 
@@ -406,6 +407,7 @@
 			error = ip_if_output(ifp, m, sintocsa(&dst.v4), NULL);
 
 		if (error) {
+			m0 = NULL;
 			goto bad;
 		}
 		goto done;