Those are for the gateway sockaddrs which get allocated in rt_setgate() with the same ROUNDUP(sa_len) approach.
mpi already added a sizes for a few rt_gateway sockaddrs in two commits, these are the last one in route.c leaving only ifafree() behind. Also tested on a few machines during last weeks. Feedback? OK? Index: route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.394 diff -u -p -r1.394 route.c --- route.c 24 Jun 2020 22:03:43 -0000 1.394 +++ route.c 27 Jul 2020 00:10:17 -0000 @@ -932,7 +932,8 @@ rtrequest(int req, struct rt_addrinfo *i ifafree(ifa); rtfree(rt->rt_parent); rt_putgwroute(rt); - free(rt->rt_gateway, M_RTABLE, 0); + free(rt->rt_gateway, M_RTABLE, + ROUNDUP(rt->rt_gateway->sa_len)); free(ndst, M_RTABLE, ndst->sa_len); pool_put(&rtentry_pool, rt); return (error); @@ -964,7 +965,8 @@ rtrequest(int req, struct rt_addrinfo *i ifafree(ifa); rtfree(rt->rt_parent); rt_putgwroute(rt); - free(rt->rt_gateway, M_RTABLE, 0); + free(rt->rt_gateway, M_RTABLE, + ROUNDUP(rt->rt_gateway->sa_len)); free(ndst, M_RTABLE, ndst->sa_len); pool_put(&rtentry_pool, rt); return (EEXIST);