routing link local addresses: where to put the scope id?

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

So which of the two forms (scope in sin6_scope_id or KAME-stuffed into 
sin6_addr) do the rt* routines expect?
My impression is that although rtcache_setdst() takes a sockaddr (as do 
rtalloc() and rt_matchaddr()), they in the end (via rtoffset) only operate 
on sin6_addr, so the would need the KAME-stuffed form.
But that would mean I either overlook something or even the relativey 
high-level ip6_output() routine would need to be called with the 
KAME-stuffed form.

The point I'm asking all this is that I'm investigating why ipf fails to 
send TCP RSTs over link-local addresses. I've tracked this down as far as 
that ipf6_fastroute() calls nd6_output() with a gateway route, causing 
EHOSTUNREACH. My impression is that ipf_fastroute6() fails to tell the 
routing routines about the LL scope -- I just don't know whether it should 
do the KAME stuffing before calling  the routing routines or whether it 
should call rtcache_setdst() with sin6_scope_id filled in?