Index: sys/net/route/route_helpers.c
===================================================================
--- sys/net/route/route_helpers.c
+++ sys/net/route/route_helpers.c
@@ -91,8 +91,7 @@
  * Wrapper for the control plane functions for performing af-agnostic
  *  lookups.
  * @fibnum: fib to perform the lookup.
- * @dst: sockaddr with family and addr filled in. IPv6 addresses needs to be in
- *  deembedded from.
+ * @dst: sockaddr with family and addr filled in.
  * @flags: fib(9) flags.
  * @flowid: flow id for path selection in multipath use case.
  *
Index: sys/net/rtsock.c
===================================================================
--- sys/net/rtsock.c
+++ sys/net/rtsock.c
@@ -171,8 +171,6 @@
 static struct mbuf *rtsock_msg_mbuf(int type, struct rt_addrinfo *rtinfo);
 static int	rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo,
 			struct walkarg *w, int *plen);
-static int	rt_xaddrs(caddr_t cp, caddr_t cplim,
-			struct rt_addrinfo *rtinfo);
 static int	sysctl_dumpentry(struct radix_node *rn, void *vw);
 static int	sysctl_dumpnhop(struct rtentry *rt, struct nhop_object *nh,
 			uint32_t weight, struct walkarg *w);
@@ -578,14 +576,6 @@
 	info->rti_mflags = rtm->rtm_inits;
 	info->rti_rmx = &rtm->rtm_rmx;
 
-	/*
-	 * rt_xaddrs() performs s6_addr[2] := sin6_scope_id for AF_INET6
-	 * link-local address because rtrequest requires addresses with
-	 * embedded scope id.
-	 */
-	if (rt_xaddrs((caddr_t)(rtm + 1), len + (caddr_t)rtm, info))
-		return (EINVAL);
-
 	if (rtm->rtm_flags & RTF_RNH_LOCKED)
 		return (EINVAL);
 	info->rti_flags = rtm->rtm_flags;
@@ -875,11 +865,6 @@
 	struct rtentry *rt = NULL;
 	struct rt_addrinfo info;
 	struct epoch_tracker et;
-#ifdef INET6
-	struct sockaddr_storage ss;
-	struct sockaddr_in6 *sin6;
-	int i, rti_need_deembed = 0;
-#endif
 	int alloc_len = 0, len, error = 0, fibnum;
 	sa_family_t saf = AF_UNSPEC;
 	struct walkarg w;
@@ -935,10 +920,6 @@
 	/* support for new ARP code */
 	if (rtm->rtm_flags & RTF_LLDATA) {
 		error = lla_rt_output(rtm, &info);
-#ifdef INET6
-		if (error == 0)
-			rti_need_deembed = 1;
-#endif
 		goto flush;
 	}
 
@@ -951,9 +932,6 @@
 		}
 		error = rib_action(fibnum, rtm->rtm_type, &info, &rc);
 		if (error == 0) {
-#ifdef INET6
-			rti_need_deembed = 1;
-#endif
 #ifdef ROUTE_MPATH
 			if (NH_IS_NHGRP(rc.rc_nh_new) ||
 			    (rc.rc_nh_old && NH_IS_NHGRP(rc.rc_nh_old))) {
@@ -984,10 +962,6 @@
 			nh = rc.rc_nh_old;
 			goto report;
 		}
-#ifdef INET6
-		/* rt_msg2() will not be used when RTM_DELETE fails. */
-		rti_need_deembed = 1;
-#endif
 		break;
 
 	case RTM_GET:
@@ -1009,14 +983,6 @@
 		 * Given that, any pointer in @info CANNOT BE USED.
 		 */
 
-		/*
-		 * scopeid deembedding has been performed while
-		 * writing updated rtm in rtsock_msg_buffer().
-		 * With that in mind, skip deembedding procedure below.
-		 */
-#ifdef INET6
-		rti_need_deembed = 0;
-#endif
 		if (error != 0)
 			senderr(error);
 		break;
@@ -1029,24 +995,6 @@
 	NET_EPOCH_EXIT(et);
 	rt = NULL;
 
-#ifdef INET6
-	if (rtm != NULL) {
-		if (rti_need_deembed) {
-			/* sin6_scope_id is recovered before sending rtm. */
-			sin6 = (struct sockaddr_in6 *)&ss;
-			for (i = 0; i < RTAX_MAX; i++) {
-				if (info.rti_info[i] == NULL)
-					continue;
-				if (info.rti_info[i]->sa_family != AF_INET6)
-					continue;
-				bcopy(info.rti_info[i], sin6, sizeof(*sin6));
-				if (sa6_recoverscope(sin6) == 0)
-					bcopy(sin6, info.rti_info[i],
-						    sizeof(*sin6));
-			}
-		}
-	}
-#endif
 	send_rtm_reply(so, rtm, m, saf, fibnum, error);
 
 	return (error);
@@ -1121,49 +1069,6 @@
 	/* Kernel -> userland timebase conversion. */
 	out->rmx_expire = rt->rt_expire ?
 	    rt->rt_expire - time_uptime + time_second : 0;
-}
-
-/*
- * Extract the addresses of the passed sockaddrs.
- * Do a little sanity checking so as to avoid bad memory references.
- * This data is derived straight from userland.
- */
-static int
-rt_xaddrs(caddr_t cp, caddr_t cplim, struct rt_addrinfo *rtinfo)
-{
-	struct sockaddr *sa;
-	int i;
-
-	for (i = 0; i < RTAX_MAX && cp < cplim; i++) {
-		if ((rtinfo->rti_addrs & (1 << i)) == 0)
-			continue;
-		sa = (struct sockaddr *)cp;
-		/*
-		 * It won't fit.
-		 */
-		if (cp + sa->sa_len > cplim)
-			return (EINVAL);
-		/*
-		 * there are no more.. quit now
-		 * If there are more bits, they are in error.
-		 * I've seen this. route(1) can evidently generate these. 
-		 * This causes kernel to core dump.
-		 * for compatibility, If we see this, point to a safe address.
-		 */
-		if (sa->sa_len == 0) {
-			rtinfo->rti_info[i] = &sa_zero;
-			return (0); /* should be EINVAL but for compat */
-		}
-		/* accept it */
-#ifdef INET6
-		if (sa->sa_family == AF_INET6)
-			sa6_embedscope((struct sockaddr_in6 *)sa,
-			    V_ip6_use_defzone);
-#endif
-		rtinfo->rti_info[i] = sa;
-		cp += SA_SIZE(sa);
-	}
-	return (0);
 }
 
 /*
Index: sys/netinet6/in6_fib.c
===================================================================
--- sys/netinet6/in6_fib.c
+++ sys/netinet6/in6_fib.c
@@ -104,7 +104,6 @@
 
 /*
  * Looks up path in fib @fibnum specified by @dst.
- * Assumes scope is deembedded and provided in @scopeid.
  *
  * Returns path nexthop on success. Nexthop is safe to use
  *  within the current network epoch. If longer lifetime is required,
Index: sys/netinet6/ip6_forward.c
===================================================================
--- sys/netinet6/ip6_forward.c
+++ sys/netinet6/ip6_forward.c
@@ -167,13 +167,13 @@
 	}
 #endif
 	/*
-	 * ip6_forward() operates with IPv6 addresses with deembedded scope.
+	 * ip6_forward() operates with IPv6 addresse.
 	 *
 	 * There are 3 sources of IPv6 destination address:
 	 *
-	 * 1) ip6_input(), where ip6_dst contains deembedded address.
-	 *   In order to deal with forwarding of link-local packets,
-	 *   calculate the scope based on input interface (RFC 4007, clause 9).
+	 * 1) ip6_input(). In order to deal with forwarding of link-local
+	 *   packets, calculate the scope based on input interface (RFC
+	 *   4007, clause 9).
 	 * 2) packet filters changing ip6_dst directly. It would embed scope
 	 *   for LL addresses, so in6_localip() performs properly.
 	 * 3) packet filters attaching PACKET_TAG_IPFORWARD would embed
@@ -241,13 +241,6 @@
 		IP6STAT_INC(ip6s_cantforward);
 		IP6STAT_INC(ip6s_badscope);
 		goto bad;
-	}
-
-	if (nh->nh_flags & NHF_GATEWAY) {
-		/* Store gateway address in deembedded form */
-		dst.sin6_addr = nh->gw6_sa.sin6_addr;
-		dst.sin6_scope_id = ntohs(in6_getscope(&dst.sin6_addr));
-		in6_clearscope(&dst.sin6_addr);
 	}
 
 	/*