ip6_forward() looked the route up with NHR_REF and released the nexthop
before returning. It runs in the network epoch and uses the nexthop
only until it returns: nd6_output_ifp() gets the interface, and
icmp6_redirect_output() runs before the return. The epoch keeps the
nexthop valid that long, which ip6_tryforward() already relies on.
Every packet that takes this path wrote twice to the nexthop reference
count, which all CPUs forwarding to that nexthop share. Forwarded
packets take it whenever IPsec has a security policy, and today also
whenever net.inet6.ip6.redirect is set, which is the default.
Look the nexthop up without a reference, and assert that the caller is
in the network epoch.
No functional change intended.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")