!
! In the IPv6 case, in case a callout was pending we still hold
! a reference that before was never released.  Do so now to avoid
! leakage of resources in case we free the table.
!
! Sponsored by: ISPsystem
! Reviewed by:  
! MFC After:    
!
Index: sys/net/if_llatbl.c
===================================================================
--- sys/net/if_llatbl.c	(revision 203915)
+++ sys/net/if_llatbl.c	(working copy)
@@ -165,9 +165,19 @@ lltable_free(struct lltable *llt)
 
 	for (i=0; i < LLTBL_HASHTBL_SIZE; i++) {
 		LIST_FOREACH_SAFE(lle, &llt->lle_head[i], lle_next, next) {
+			int cancelled;
 
-			callout_drain(&lle->la_timer);
+			cancelled = callout_drain(&lle->la_timer);
 			LLE_WLOCK(lle);
+#ifdef INET6
+			/*
+			 * In case a callout was pending, we still hold an
+			 * extra reference we need to free in the IPv6 case
+			 * (see nd6_llinfo_settimer_locked() logic).
+			 */
+			if (llt->llt_af == AF_INET6 && cancelled)
+				LLE_REMREF(lle);
+#endif
 			llentry_free(lle);
 		}
 	}