nd6_ns_output() creates new mbuf 'm' to send ND6 NS, but it doesn't initialize m->m_pkthdr.fibnum. In some cases it is possible, that ip6_output() will be called and M_GETFIB() will be used to determine fibnum used in in6_selectroute_fib(). M_GETFIB() can return some random number (fibnum wasn't properly initialized), this can lead to panic in the routing code.
I created nd6_ns_output_fib() function similar to nd6_na_output_fib().