void
  rtalloc(struct route *ro)
  {
          if (ro->ro_rt && ro->ro_rt->rt_ifp && (ro->ro_rt->rt_flags & RTF_UP))
                  return;                          /* XXX */
          ro->ro_rt = rtalloc1(&ro->ro_dst, 1);
  }

It looks to me as if rtalloc() leaks an rtentry every time ro->ro_rt !=
NULL but (ro->ro_rt->rt_ifp == NULL || (ro->ro_rt->rt_flags & RTF_UP)==0.
Shouldn't it RTFREE() ro->ro_rt before setting it to something new?
That is, rtalloc() ought to read like this:

  void
  rtalloc(struct route *ro)
  {
  		if (ro->ro_rt && ro->ro_rt->rt_ifp && (ro->ro_rt->rt_flags & RTF_UP))
  				return;                          /* XXX */
  		if (ro->ro_rt != NULL)
  				RTFREE(ro->ro_rt);
  		ro->ro_rt = rtalloc1(&ro->ro_dst, 1);
  }

No?

Dave

-- 
David Young             OJC Technologies
dyoung@ojctech.com      Urbana, IL * (217) 278-3933