diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c --- a/sys/netinet6/icmp6.c +++ b/sys/netinet6/icmp6.c @@ -2087,6 +2087,12 @@ hlim = 0; srcp = NULL; + if (__predict_false(IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src))) { + nd6log((LOG_DEBUG, + "icmp6_reflect: source address is unspecified\n")); + goto bad; + } + /* * If the incoming packet was addressed directly to us (i.e. unicast), * use dst as the src for the reply. diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -109,7 +109,8 @@ */ if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 || IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { IP6STAT_INC(ip6s_cantforward); /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ if (V_ip6_log_cannot_forward && ip6_log_ratelimit()) {