Instead of asking for a reference in rtrequest1(9) simply pass NULL and let the function call rtfree(9) for us.
rt_missmsg() does not need the route to be alive, so it's fine. Ok? Index: net/route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.222 diff -u -p -r1.222 route.c --- net/route.c 19 Aug 2015 10:42:37 -0000 1.222 +++ net/route.c 19 Aug 2015 11:11:28 -0000 @@ -566,15 +566,9 @@ rtdeletemsg(struct rtentry *rt, u_int ta info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; info.rti_flags = rt->rt_flags; ifp = rt->rt_ifp; - error = rtrequest1(RTM_DELETE, &info, rt->rt_priority, &rt, tableid); - + error = rtrequest1(RTM_DELETE, &info, rt->rt_priority, NULL, tableid); rt_missmsg(RTM_DELETE, &info, info.rti_flags, ifp, error, tableid); - /* Adjust the refcount */ - if (error == 0 && rt->rt_refcnt <= 0) { - rt->rt_refcnt++; - rtfree(rt); - } return (error); }