Index: sys/netinet/ip_output.c
===================================================================
--- sys/netinet/ip_output.c
+++ sys/netinet/ip_output.c
@@ -227,7 +227,7 @@
 	struct route iproute;
 	struct rtentry *rte;	/* cache for ro->ro_rt */
 	uint32_t fibnum;
-	int have_ia_ref;
+	struct in_addr ia_addr;
 #ifdef IPSEC
 	int no_route_but_check_spd = 0;
 #endif
@@ -294,7 +294,7 @@
 	}
 again:
 	ia = NULL;
-	have_ia_ref = 0;
+	ia_addr.s_addr = INADDR_ANY;
 	/*
 	 * If routing to interface only, short circuit routing lookup.
 	 * The use of an all-ones broadcast address implies this; an
@@ -310,10 +310,11 @@
 			error = ENETUNREACH;
 			goto bad;
 		}
-		have_ia_ref = 1;
+		ifp = ia->ia_ifp;
+		ia_addr = IA_SIN(ia)->sin_addr;
+		ifa_free(&ia->ia_ifa);
 		ip->ip_dst.s_addr = INADDR_BROADCAST;
 		dst->sin_addr = ip->ip_dst;
-		ifp = ia->ia_ifp;
 		ip->ip_ttl = 1;
 		isbroadcast = 1;
 	} else if (flags & IP_ROUTETOIF) {
@@ -325,8 +326,9 @@
 			error = ENETUNREACH;
 			goto bad;
 		}
-		have_ia_ref = 1;
 		ifp = ia->ia_ifp;
+		ia_addr = IA_SIN(ia)->sin_addr;
+		ifa_free(&ia->ia_ifa);
 		ip->ip_ttl = 1;
 		isbroadcast = in_broadcast(dst->sin_addr, ifp);
 	} else if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
@@ -337,8 +339,10 @@
 		 */
 		ifp = imo->imo_multicast_ifp;
 		IFP_TO_IA(ifp, ia, &in_ifa_tracker);
-		if (ia)
-			have_ia_ref = 1;
+		if (ia) {
+			ia_addr = IA_SIN(ia)->sin_addr;
+			ifa_free(&ia->ia_ifa);
+		}
 		isbroadcast = 0;	/* fool gcc */
 	} else {
 		/*
@@ -374,6 +378,8 @@
 			goto bad;
 		}
 		ia = ifatoia(rte->rt_ifa);
+		if (ia)
+			ia_addr = IA_SIN(ia)->sin_addr;
 		ifp = rte->rt_ifp;
 		counter_u64_add(rte->rt_pksent, 1);
 		if (rte->rt_flags & RTF_GATEWAY)
@@ -432,8 +438,7 @@
 		 */
 		if (ip->ip_src.s_addr == INADDR_ANY) {
 			/* Interface may have no addresses. */
-			if (ia != NULL)
-				ip->ip_src = IA_SIN(ia)->sin_addr;
+			ip->ip_src = ia_addr;
 		}
 
 		if ((imo == NULL && in_mcast_loop) ||
@@ -499,9 +504,7 @@
 	 */
 	if (ip->ip_src.s_addr == INADDR_ANY) {
 		/* Interface may have no addresses. */
-		if (ia != NULL) {
-			ip->ip_src = IA_SIN(ia)->sin_addr;
-		}
+		ip->ip_src = ia_addr;
 	}
 
 	/*
@@ -565,8 +568,6 @@
 		case -1: /* Need to try again */
 			/* Reset everything for a new round */
 			RO_RTFREE(ro);
-			if (have_ia_ref)
-				ifa_free(&ia->ia_ifa);
 			ro->ro_prepend = NULL;
 			rte = NULL;
 			gw = dst;
@@ -610,21 +611,6 @@
 			m->m_pkthdr.csum_flags &= ~CSUM_IP;
 		}
 
-		/*
-		 * Record statistics for this interface address.
-		 * With CSUM_TSO the byte/packet count will be slightly
-		 * incorrect because we count the IP+TCP headers only
-		 * once instead of for every generated packet.
-		 */
-		if (!(flags & IP_FORWARDING) && ia) {
-			if (m->m_pkthdr.csum_flags & CSUM_TSO)
-				counter_u64_add(ia->ia_ifa.ifa_opackets,
-				    m->m_pkthdr.len / m->m_pkthdr.tso_segsz);
-			else
-				counter_u64_add(ia->ia_ifa.ifa_opackets, 1);
-
-			counter_u64_add(ia->ia_ifa.ifa_obytes, m->m_pkthdr.len);
-		}
 #ifdef MBUF_STRESS_TEST
 		if (mbuf_frag_size && m->m_pkthdr.len > mbuf_frag_size)
 			m = m_fragment(m, M_NOWAIT, mbuf_frag_size);
@@ -658,12 +644,7 @@
 		m0 = m->m_nextpkt;
 		m->m_nextpkt = 0;
 		if (error == 0) {
-			/* Record statistics for this interface address. */
-			if (ia != NULL) {
-				counter_u64_add(ia->ia_ifa.ifa_opackets, 1);
-				counter_u64_add(ia->ia_ifa.ifa_obytes,
-				    m->m_pkthdr.len);
-			}
+
 			/*
 			 * Reset layer specific mbuf flags
 			 * to avoid confusing upper layers.
@@ -690,8 +671,6 @@
 		 * calling RTFREE on it again.
 		 */
 		ro->ro_rt = NULL;
-	if (have_ia_ref)
-		ifa_free(&ia->ia_ifa);
 	return (error);
 bad:
 	m_freem(m);
Index: sys/netinet6/ip6_output.c
===================================================================
--- sys/netinet6/ip6_output.c
+++ sys/netinet6/ip6_output.c
@@ -928,17 +928,6 @@
 	 * transmit packet without fragmentation
 	 */
 	if (dontfrag || (!alwaysfrag && tlen <= mtu)) {	/* case 1-a and 2-a */
-		struct in6_ifaddr *ia6;
-
-		ip6 = mtod(m, struct ip6_hdr *);
-		ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
-		if (ia6) {
-			/* Record statistics for this interface address. */
-			counter_u64_add(ia6->ia_ifa.ifa_opackets, 1);
-			counter_u64_add(ia6->ia_ifa.ifa_obytes,
-			    m->m_pkthdr.len);
-			ifa_free(&ia6->ia_ifa);
-		}
 		error = nd6_output_ifp(ifp, origifp, m, dst, NULL);
 		goto done;
 	}
@@ -1031,15 +1020,9 @@
 	for (m0 = m; m; m = m0) {
 		m0 = m->m_nextpkt;
 		m->m_nextpkt = 0;
-		if (error == 0) {
-			/* Record statistics for this interface address. */
-			if (ia) {
-				counter_u64_add(ia->ia_ifa.ifa_opackets, 1);
-				counter_u64_add(ia->ia_ifa.ifa_obytes,
-				    m->m_pkthdr.len);
-			}
+		if (error == 0)
 			error = nd6_output_ifp(ifp, origifp, m, dst, NULL);
-		} else
+		else
 			m_freem(m);
 	}