IPv6: Fix a panic in the nd6 code with unmapped mbufs.

[gallatin]

Summary

If the neighbor entry for an IPv6 TCP session using unmapped
mbufs times out, IPv6 will send an icmp6 dest. unreachable
message. In doing this, it will try to do a software checksum
on the reflected packet. If this is a TCP session using unmapped
mbufs, then there will be a kernel panic.

To fix this, just free mbufs with unmapped mbufs before the icmp
is generated.

[np]

Looks good (other than the yoda style in one conditional).

sys/netinet6/nd6.c

833

Yoda style isn't consistent with the rest of this file.

[jhb]

Perhaps adjust the commit message to say something like "To fix this, discard the packet rather than than sending the ICMP message". Right now "free mbufs before the icmp is generated" implied to me that we would still send the ICMP, but perhaps with altered content rather than skipping it entirely.