MBuf leak in ether_output()

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

I'm still chasing down an MBuf leak and it looks like I've found the culprit.

static int
ether_output(struct ifnet * const ifp0, struct mbuf * const m0,
	const struct sockaddr * const dst,
	const struct rtentry *rt)
{
[...]
	case AF_INET6:
[...]
		} else {
			error = nd6_resolve(ifp, rt, m, dst, edst,
			    sizeof(edst));
			if (error != 0)
				return error == EWOULDBLOCK ? 0 : error;
			}
		}
[...]
}

In the EWOULDBLOCK case, 0 is returned, but who frees m?

With my current debugging setup, I'm sure the lost mbufs run through the 
AF_INET6 case, but don't reach the end of that switch statement, so I'm 
pretty sure that's the point where they get orphaned.

There is similar code in the AF_INET case for arpresolve(), which doesn't 
seem to cause harm, probably arpresolve() never returns EWOULDBLOCK?