Index: sys/netinet6/icmp6.c
===================================================================
--- sys/netinet6/icmp6.c
+++ sys/netinet6/icmp6.c
@@ -2103,12 +2103,14 @@
 		ia = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */, false);
 		if (ia != NULL && !(ia->ia6_flags &
 		    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY))) {
+			struct nd_ifinfo *ndi = nd6_ifinfo(m->m_pkthdr.rcvif);
+
 			src6 = ia->ia_addr.sin6_addr;
 			srcp = &src6;
 
-			if (m->m_pkthdr.rcvif != NULL) {
+			if (ndi != NULL) {
 				/* XXX: This may not be the outgoing interface */
-				hlim = ND_IFINFO(m->m_pkthdr.rcvif)->chlim;
+				hlim = ndi->chlim;
 			} else
 				hlim = V_ip6_defhlim;
 		}
Index: sys/netinet6/in6.c
===================================================================
--- sys/netinet6/in6.c
+++ sys/netinet6/in6.c
@@ -1609,9 +1609,11 @@
 {
 	struct epoch_tracker et;
 	struct sockaddr_in6 *sin6;
+	struct nd_ifinfo *ndi;
 	struct ifaddr *ifa;
 
-	if (ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)
+	if ((ndi = nd6_ifinfo(ifp)) != NULL &&
+	    (ndi->flags & ND6_IFF_IFDISABLED) != 0)
 		return (NULL);
 	NET_EPOCH_ENTER(et);
 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
@@ -1993,13 +1995,14 @@
 int
 in6if_do_dad(struct ifnet *ifp)
 {
+	struct nd_ifinfo *ndi;
 
 	if ((ifp->if_flags & IFF_LOOPBACK) != 0)
 		return (0);
 	if ((ifp->if_flags & IFF_MULTICAST) == 0)
 		return (0);
-	if ((ND_IFINFO(ifp)->flags &
-	    (ND6_IFF_IFDISABLED | ND6_IFF_NO_DAD)) != 0)
+	if ((ndi = nd6_ifinfo(ifp)) == NULL ||
+	    (ndi->flags & (ND6_IFF_IFDISABLED | ND6_IFF_NO_DAD)) != 0)
 		return (0);
 	return (1);
 }
Index: sys/netinet6/in6_ifattach.c
===================================================================
--- sys/netinet6/in6_ifattach.c
+++ sys/netinet6/in6_ifattach.c
@@ -675,8 +675,9 @@
 in6_ifattach(struct ifnet *ifp, struct ifnet *altifp)
 {
 	struct in6_ifaddr *ia;
+	struct nd_ifinfo *ndi;
 
-	if (ifp->if_afdata[AF_INET6] == NULL)
+	if ((ndi = nd6_ifinfo(ifp)) == NULL)
 		return;
 	/*
 	 * quirks based on interface type
@@ -689,8 +690,8 @@
 		 * linklocals for 6to4 interface, but there's no use and
 		 * it is rather harmful to have one.
 		 */
-		ND_IFINFO(ifp)->flags &= ~ND6_IFF_AUTO_LINKLOCAL;
-		ND_IFINFO(ifp)->flags |= ND6_IFF_NO_DAD;
+		ndi->flags &= ~ND6_IFF_AUTO_LINKLOCAL;
+		ndi->flags |= ND6_IFF_NO_DAD;
 		break;
 	default:
 		break;
@@ -721,8 +722,8 @@
 	/*
 	 * assign a link-local address, if there's none.
 	 */
-	if (!(ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
-	    ND_IFINFO(ifp)->flags & ND6_IFF_AUTO_LINKLOCAL) {
+	if ((ndi->flags & ND6_IFF_IFDISABLED) == 0 &&
+	    (ndi->flags & ND6_IFF_AUTO_LINKLOCAL) != 0) {
 		struct epoch_tracker et;
 
 		NET_EPOCH_ENTER(et);
@@ -803,8 +804,11 @@
 in6_get_tmpifid(struct ifnet *ifp, u_int8_t *retbuf,
     const u_int8_t *baseid, int generate)
 {
+	struct nd_ifinfo *ndi = nd6_ifinfo(ifp);
 	u_int8_t nullbuf[8];
-	struct nd_ifinfo *ndi = ND_IFINFO(ifp);
+
+	if (ndi == NULL)
+		return (ENXIO);
 
 	bzero(nullbuf, sizeof(nullbuf));
 	if (bcmp(ndi->randomid, nullbuf, sizeof(nullbuf)) == 0) {
@@ -840,9 +844,8 @@
 	bzero(nullbuf, sizeof(nullbuf));
 	NET_EPOCH_ENTER(et);
 	CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) {
-		if (ifp->if_afdata[AF_INET6] == NULL)
+		if ((ndi = nd6_ifinfo(ifp)) == NULL)
 			continue;
-		ndi = ND_IFINFO(ifp);
 		if (bcmp(ndi->randomid, nullbuf, sizeof(nullbuf)) != 0) {
 			/*
 			 * We've been generating a random ID on this interface.
Index: sys/netinet6/ip6_input.c
===================================================================
--- sys/netinet6/ip6_input.c
+++ sys/netinet6/ip6_input.c
@@ -536,6 +536,7 @@
 	struct ip6_hdr *ip6;
 	struct in6_ifaddr *ia;
 	struct ifnet *rcvif;
+	struct nd_ifinfo *ndi;
 	u_int32_t plen;
 	u_int32_t rtalert = ~0;
 	int off = sizeof(struct ip6_hdr), nest;
@@ -546,7 +547,8 @@
 	 * Drop the packet if IPv6 operation is disabled on the interface.
 	 */
 	rcvif = m->m_pkthdr.rcvif;
-	if ((ND_IFINFO(rcvif)->flags & ND6_IFF_IFDISABLED))
+	if ((ndi = nd6_ifinfo(rcvif)) == NULL ||
+	    (ndi->flags & ND6_IFF_IFDISABLED) != 0)
 		goto bad;
 
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
Index: sys/netinet6/nd6.h
===================================================================
--- sys/netinet6/nd6.h
+++ sys/netinet6/nd6.h
@@ -105,6 +105,15 @@
 	    ? ND_IFINFO(ifp)->linkmtu \
 	    : ((ND_IFINFO(ifp)->maxmtu && ND_IFINFO(ifp)->maxmtu < (ifp)->if_mtu) \
 		? ND_IFINFO(ifp)->maxmtu : (ifp)->if_mtu))
+
+static inline struct nd_ifinfo *
+nd6_ifinfo(struct ifnet *ifp)
+{
+	if (ifp != NULL && (ifp->if_flags & IFF_DYING) == 0 &&
+	    ifp->if_afdata[AF_INET6] != NULL)
+		return (ND_IFINFO(ifp));
+	return (NULL);
+}
 #endif
 
 struct in6_nbrinfo {
Index: sys/netinet6/nd6_nbr.c
===================================================================
--- sys/netinet6/nd6_nbr.c
+++ sys/netinet6/nd6_nbr.c
@@ -1341,6 +1341,7 @@
 	struct ifaddr *ifa = dp->dad_ifa;
 	struct ifnet *ifp = dp->dad_ifa->ifa_ifp;
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
+	struct nd_ifinfo *ndi;
 	char ip6buf[INET6_ADDRSTRLEN];
 	struct epoch_tracker et;
 
@@ -1348,7 +1349,8 @@
 	KASSERT(ia != NULL, ("DAD entry %p with no address", dp));
 
 	NET_EPOCH_ENTER(et);
-	if (ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) {
+	if ((ndi = nd6_ifinfo(ifp)) == NULL ||
+	    (ndi->flags & ND6_IFF_IFDISABLED) != 0) {
 		/* Do not need DAD for ifdisabled interface. */
 		log(LOG_ERR, "nd6_dad_timer: cancel DAD on %s because of "
 		    "ND6_IFF_IFDISABLED.\n", ifp->if_xname);
@@ -1427,7 +1429,7 @@
 			 * again in case that it is changed between the
 			 * beginning of this function and here.
 			 */
-			if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) == 0)
+			if ((ndi->flags & ND6_IFF_IFDISABLED) == 0)
 				ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
 
 			nd6log((LOG_DEBUG,