Index: sys/netinet/raw_ip.c
===================================================================
--- sys/netinet/raw_ip.c	(revision 187596)
+++ sys/netinet/raw_ip.c	(working copy)
@@ -338,8 +338,8 @@
  * Generate IP header and pass packet to ip_output.  Tack on options user may
  * have setup with control call.
  */
-int
-rip_output(struct mbuf *m, struct socket *so, u_long dst)
+static int
+rip_output_internal(struct mbuf *m, struct socket *so, u_long dst)
 {
 	INIT_VNET_INET(so->so_vnet);
 	struct ip *ip;
@@ -428,6 +428,18 @@
 	return (error);
 }
 
+int
+rip_output(struct mbuf *m, struct socket *so)
+{
+
+	/*
+	 * XXX-BZ we are not expecting this to be called from pr_output.
+	 * Once we are sure, remove the pr_output = rip_output
+	 * initializations and rip_output() altogether.
+	 */
+	panic("%s: not expected to be called (via pr_output)", __func__);
+}
+
 /*
  * Raw IP socket option processing.
  *
@@ -898,7 +910,7 @@
 		}
 		dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
 	}
-	return (rip_output(m, so, dst));
+	return (rip_output_internal(m, so, dst));
 }
 
 static int
Index: sys/netinet/in_gif.c
===================================================================
--- sys/netinet/in_gif.c	(revision 187596)
+++ sys/netinet/in_gif.c	(working copy)
@@ -81,7 +81,7 @@
 	.pr_protocol =		0/* IPPROTO_IPV[46] */,
 	.pr_flags =		PR_ATOMIC|PR_ADDR,
 	.pr_input =		in_gif_input,
-	.pr_output =		(pr_output_t*)rip_output,
+	.pr_output =		rip_output,
 	.pr_ctloutput =		rip_ctloutput,
 	.pr_usrreqs =		&rip_usrreqs
 };
Index: sys/netinet/ip_mroute.c
===================================================================
--- sys/netinet/ip_mroute.c	(revision 187596)
+++ sys/netinet/ip_mroute.c	(working copy)
@@ -229,7 +229,7 @@
 	.pr_protocol =		IPPROTO_PIM,
 	.pr_flags =		PR_ATOMIC|PR_ADDR|PR_LASTHDR,
 	.pr_input =		pim_input,
-	.pr_output =		(pr_output_t*)rip_output,
+	.pr_output =		rip_output,
 	.pr_ctloutput =		rip_ctloutput,
 	.pr_usrreqs =		&rip_usrreqs
 };
Index: sys/netinet/ip_var.h
===================================================================
--- sys/netinet/ip_var.h	(revision 187596)
+++ sys/netinet/ip_var.h	(working copy)
@@ -224,7 +224,7 @@
 void	rip_ctlinput(int, struct sockaddr *, void *);
 void	rip_init(void);
 void	rip_input(struct mbuf *, int);
-int	rip_output(struct mbuf *, struct socket *, u_long);
+int	rip_output(struct mbuf *, struct socket *);
 void	ipip_input(struct mbuf *, int);
 void	rsvp_input(struct mbuf *, int);
 int	ip_rsvp_init(struct socket *);
Index: sys/netinet/in_proto.c
===================================================================
--- sys/netinet/in_proto.c	(revision 187596)
+++ sys/netinet/in_proto.c	(working copy)
@@ -326,7 +326,7 @@
 	.pr_protocol =		IPPROTO_CARP,
 	.pr_flags =		PR_ATOMIC|PR_ADDR,
 	.pr_input =		carp_input,
-	.pr_output =		(pr_output_t*)rip_output,
+	.pr_output =		rip_output,
 	.pr_ctloutput =		rip_ctloutput,
 	.pr_usrreqs =		&rip_usrreqs
 },
Index: sys/net/if_stf.c
===================================================================
--- sys/net/if_stf.c	(revision 187596)
+++ sys/net/if_stf.c	(working copy)
@@ -167,7 +167,7 @@
 	.pr_protocol =		IPPROTO_IPV6,
 	.pr_flags =		PR_ATOMIC|PR_ADDR,
 	.pr_input =		in_stf_input,
-	.pr_output =		(pr_output_t *)rip_output,
+	.pr_output =		rip_output,
 	.pr_ctloutput =		rip_ctloutput,
 	.pr_usrreqs =		&rip_usrreqs
 };
Index: sys/net/if_gre.c
===================================================================
--- sys/net/if_gre.c	(revision 187596)
+++ sys/net/if_gre.c	(working copy)
@@ -126,7 +126,7 @@
 	.pr_protocol =		IPPROTO_GRE,
 	.pr_flags =		PR_ATOMIC|PR_ADDR,
 	.pr_input =		gre_input,
-	.pr_output =		(pr_output_t *)rip_output,
+	.pr_output =		rip_output,
 	.pr_ctlinput =		rip_ctlinput,
 	.pr_ctloutput =		rip_ctloutput,
 	.pr_usrreqs =		&rip_usrreqs
@@ -137,7 +137,7 @@
 	.pr_protocol =		IPPROTO_MOBILE,
 	.pr_flags =		PR_ATOMIC|PR_ADDR,
 	.pr_input =		gre_mobile_input,
-	.pr_output =		(pr_output_t *)rip_output,
+	.pr_output =		rip_output,
 	.pr_ctlinput =		rip_ctlinput,
 	.pr_ctloutput =		rip_ctloutput,
 	.pr_usrreqs =		&rip_usrreqs
Index: sys/netinet6/ip6protosw.h
===================================================================
--- sys/netinet6/ip6protosw.h	(revision 187596)
+++ sys/netinet6/ip6protosw.h	(working copy)
@@ -120,7 +120,7 @@
 	int	(*pr_input)		/* input to protocol (from below) */
 			__P((struct mbuf **, int *, int));
 	int	(*pr_output)		/* output to protocol (from above) */
-			__P((struct mbuf *, ...));
+			(struct mbuf *, struct socket *);
 	void	(*pr_ctlinput)		/* control input (from below) */
 			__P((int, struct sockaddr *, void *));
 	int	(*pr_ctloutput)		/* control output (from above) */
Index: sys/netinet6/raw_ip6.c
===================================================================
--- sys/netinet6/raw_ip6.c	(revision 187596)
+++ sys/netinet6/raw_ip6.c	(working copy)
@@ -322,19 +322,11 @@
  * Generate IPv6 header and pass packet to ip6_output.  Tack on options user
  * may have setup with control call.
  */
-int
-#if __STDC__
-rip6_output(struct mbuf *m, ...)
-#else
-rip6_output(m, va_alist)
-	struct mbuf *m;
-	va_dcl
-#endif
+static int
+rip6_output_internal(struct mbuf *m, struct socket *so,
+    struct sockaddr_in6 *dstsock, struct mbuf *control)
 {
 	INIT_VNET_INET6(curvnet);
-	struct mbuf *control;
-	struct socket *so;
-	struct sockaddr_in6 *dstsock;
 	struct in6_addr *dst;
 	struct ip6_hdr *ip6;
 	struct inpcb *in6p;
@@ -345,14 +337,7 @@
 	int type = 0, code = 0;		/* for ICMPv6 output statistics only */
 	int scope_ambiguous = 0;
 	struct in6_addr *in6a;
-	va_list ap;
 
-	va_start(ap, m);
-	so = va_arg(ap, struct socket *);
-	dstsock = va_arg(ap, struct sockaddr_in6 *);
-	control = va_arg(ap, struct mbuf *);
-	va_end(ap);
-
 	in6p = sotoinpcb(so);
 	INP_WLOCK(in6p);
 
@@ -499,6 +484,18 @@
 	return (error);
 }
 
+int
+rip6_output(struct mbuf *m, struct socket *so)
+{
+
+	/*
+	 * XXX-BZ we are not expecting this to be called from pr_output.
+	 * Once we are sure, remove the pr_output = rip6_output
+	 * initializations and rip6_output() altogether.
+	 */
+	panic("%s: not expected to be called (via pr_output)", __func__);
+}
+
 /*
  * Raw IPv6 socket option processing.
  */
@@ -832,7 +829,7 @@
 			return(EAFNOSUPPORT);
 		}
 	}
-	ret = rip6_output(m, so, dst, control);
+	ret = rip6_output_internal(m, so, dst, control);
 	return (ret);
 }
 
Index: sys/netinet6/ip6_var.h
===================================================================
--- sys/netinet6/ip6_var.h	(revision 187596)
+++ sys/netinet6/ip6_var.h	(working copy)
@@ -386,7 +386,7 @@
 int	rip6_input __P((struct mbuf **, int *, int));
 void	rip6_ctlinput __P((int, struct sockaddr *, void *));
 int	rip6_ctloutput __P((struct socket *, struct sockopt *));
-int	rip6_output __P((struct mbuf *, ...));
+int	rip6_output(struct mbuf *, struct socket *);
 int	rip6_usrreq __P((struct socket *,
 	    int, struct mbuf *, struct mbuf *, struct mbuf *, struct thread *));