MFC: r317343
In fill_ip6(), the value of the pointer av changes before it is free(3)ed. Thus, introduce a new variable to track the original value.