ip6_forward() keeps a copy of the start of the packet in case it has
to send an ICMPv6 error. Every exit must either pass the copy to
icmp6_error() or icmp6_redirect_output(), or free it. Three exits did
neither and leaked the copy:
- the destination scope check, when a packet would leave the zone of its destination address;
- a packet that a pfil hook redirected to a local address, which is queued for local input;
- a packet whose checksum has to be computed here and whose last header offset is not valid.
Free the copy in these three cases.
Fixes: 8a006adb2441 ("Add support for IPv6 to ipfw fwd...")
Fixes: bcb298fa9e23 ("sctp, tcp, udp: improve deferred computation...")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")