We're sure the parent is alive when a cloned route is removed from the table because removing the parent kill all the children.
Ok? Index: net/route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.230 diff -u -p -r1.230 route.c --- net/route.c 4 Sep 2015 08:43:39 -0000 1.230 +++ net/route.c 10 Sep 2015 08:21:24 -0000 @@ -830,15 +830,11 @@ rtrequest1(int req, struct rt_addrinfo * if ((rt->rt_flags & RTF_CLONING) != 0) rtflushclone(tableid, rt); - if (rt->rt_gwroute) { - rtfree(rt->rt_gwroute); - rt->rt_gwroute = NULL; - } + rtfree(rt->rt_gwroute); + rt->rt_gwroute = NULL; - if (rt->rt_parent) { - rt->rt_parent->rt_refcnt--; - rt->rt_parent = NULL; - } + rtfree(rt->rt_parent); + rt->rt_parent = NULL; rt->rt_flags &= ~RTF_UP; if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest)