In fill_ip6(), the value of the pointer av changes before it is
free(3)ed. Thus, introduce a new variable to track the original
value.

Submitted by: Tom Rix
Differential Revision: https://reviews.freebsd.org/D9962