Instead of dereferencing ``rt->rt_ifa'' to get the address, let's use ``rt_addr''.
ok? Index: netinet/in_pcb.c =================================================================== RCS file: /cvs/src/sys/netinet/in_pcb.c,v retrieving revision 1.206 diff -u -p -r1.206 in_pcb.c --- netinet/in_pcb.c 19 Apr 2016 22:16:25 -0000 1.206 +++ netinet/in_pcb.c 14 Jun 2016 09:57:25 -0000 @@ -924,8 +924,10 @@ in_selectsrc(struct in_addr **insrc, str * If we found a route, use the address * corresponding to the outgoing interface. */ - if (ro->ro_rt != NULL) - ia = ifatoia(ro->ro_rt->rt_ifa); + if (ro->ro_rt != NULL) { + *insrc = &satosin(ro->ro_rt->rt_addr)->sin_addr; + return (0); + } if (ia == NULL) return (EADDRNOTAVAIL); Index: netinet6/in6_src.c =================================================================== RCS file: /cvs/src/sys/netinet6/in6_src.c,v retrieving revision 1.72 diff -u -p -r1.72 in6_src.c --- netinet6/in6_src.c 5 Dec 2015 13:21:00 -0000 1.72 +++ netinet6/in6_src.c 14 Jun 2016 09:57:26 -0000 @@ -257,8 +257,11 @@ in6_selectsrc(struct in6_addr **in6src, ia6 = in6_ifawithscope(ifp, dst, rtableid); if_put(ifp); } - if (ia6 == NULL) /* xxx scope error ?*/ - ia6 = ifatoia6(ro->ro_rt->rt_ifa); + if (ia6 == NULL) { /* xxx scope error ?*/ + *in6src = + &satosin6(ro->ro_rt->rt_addr)->sin6_addr; + return (0); + } } if (ia6 == NULL) return (EHOSTUNREACH); /* no route */