Index: sys/kern/vfs_bio.c
===================================================================
--- sys/kern/vfs_bio.c
+++ sys/kern/vfs_bio.c
@@ -4188,6 +4188,7 @@
 		}
 		return;
 	}
+	newbsize = round_page(newbsize);
 	vm_hold_free_pages(bp, newbsize);
 	bufspace_adjust(bp, newbsize);
 }
@@ -4219,6 +4220,8 @@
 		return;
 	}
 
+	newbsize = round_page(newbsize);
+
 	/*
 	 * If the buffer is growing on its other-than-first
 	 * allocation then we revert to the page-allocation
@@ -4232,7 +4235,6 @@
 		bp->b_data = bp->b_kvabase;
 		bufmallocadjust(bp, 0);
 		bp->b_flags &= ~B_MALLOC;
-		newbsize = round_page(newbsize);
 	}
 	vm_hold_load_pages(bp, (vm_offset_t) bp->b_data + bp->b_bufsize,
 	    (vm_offset_t) bp->b_data + newbsize);
@@ -4272,8 +4274,6 @@
 
 	newbsize = roundup2(size, DEV_BSIZE);
 	if ((bp->b_flags & B_VMIO) == 0) {
-		if ((bp->b_flags & B_MALLOC) == 0)
-			newbsize = round_page(newbsize);
 		/*
 		 * Just get anonymous memory from the kernel.  Don't
 		 * mess with B_CACHE.
Index: sys/netinet6/nd6_nbr.c
===================================================================
--- sys/netinet6/nd6_nbr.c
+++ sys/netinet6/nd6_nbr.c
@@ -616,6 +616,7 @@
 	struct ifnet *ifp = m->m_pkthdr.rcvif;
 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 	struct nd_neighbor_advert *nd_na;
+	struct nd_defrouter *dr;
 	struct in6_addr daddr6 = ip6->ip6_dst;
 	struct in6_addr taddr6;
 	int flags;
@@ -634,6 +635,8 @@
 	size_t linkhdrsize;
 	int lladdr_off;
 	char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
+	int removed_defrouter = 0;
+	int nd6_locked = 0;
 
 	/* RFC 6980: Nodes MUST silently ignore fragments */
 	if(m->m_flags & M_FRAGMENTED)
@@ -741,6 +744,9 @@
 	 * discarded.
 	 */
 	IF_AFDATA_RLOCK(ifp);
+	/* Take nd6 prior to lle lock in case we call defrouter_removed(). */
+	ND6_WLOCK();
+	nd6_locked = true;
 	ln = nd6_lookup(&taddr6, LLE_EXCLUSIVE, ifp);
 	IF_AFDATA_RUNLOCK(ifp);
 	if (ln == NULL) {
@@ -869,7 +875,15 @@
 			struct ifnet *nd6_ifp;
 
 			nd6_ifp = lltable_get_ifp(ln->lle_tbl);
-			if (!defrouter_remove(&ln->r_l3addr.addr6, nd6_ifp) &&
+
+			dr = defrouter_lookup_locked(&ln->r_l3addr.addr6,
+			    nd6_ifp);
+			if (dr != NULL) {
+				defrouter_unlink(dr, NULL);
+				removed_defrouter = true;
+			}
+
+			if (!removed_defrouter &&
 			    (ND_IFINFO(nd6_ifp)->flags &
 			     ND6_IFF_ACCEPT_RTADV) != 0)
 				/*
@@ -893,6 +907,14 @@
 	if (ln != NULL)
 		LLE_WUNLOCK(ln);
 
+	if (nd6_locked)
+		ND6_WUNLOCK();
+
+	if (removed_defrouter && dr != NULL) {
+		defrouter_del(dr);
+		defrouter_rele(dr);
+	}
+
 	if (chain != NULL)
 		nd6_flush_holdchain(ifp, chain, &sin6);
 
@@ -906,6 +928,9 @@
 	if (ln != NULL)
 		LLE_WUNLOCK(ln);
 
+	if (nd6_locked)
+		ND6_WUNLOCK();
+
 	ICMP6STAT_INC(icp6s_badna);
 	m_freem(m);
 }