Index: sys/netinet/in_rmx.c
===================================================================
--- sys/netinet/in_rmx.c	(revision 208681)
+++ sys/netinet/in_rmx.c	(working copy)
@@ -121,12 +121,14 @@ in_matroute(void *v_arg, struct radix_node_head *h
 	struct radix_node *rn = rn_match(v_arg, head);
 	struct rtentry *rt = (struct rtentry *)rn;
 
-	/*XXX locking? */
-	if (rt && rt->rt_refcnt == 0) {		/* this is first reference */
-		if (rt->rt_flags & RTPRF_OURS) {
+	if (rt) {
+		RT_LOCK(rt);
+		if (rt->rt_refcnt == 0 &&	/* this is first reference */
+		    rt->rt_flags & RTPRF_OURS) {
 			rt->rt_flags &= ~RTPRF_OURS;
 			rt->rt_rmx.rmx_expire = 0;
 		}
+		RT_UNLOCK(rt);
 	}
 	return rn;
 }
@@ -206,6 +208,7 @@ in_rtqkill(struct radix_node *rn, void *rock)
 
 	RADIX_NODE_HEAD_WLOCK_ASSERT(ap->rnh);
 
+	RT_LOCK(rt);
 	if (rt->rt_flags & RTPRF_OURS) {
 		ap->found++;
 
@@ -234,6 +237,7 @@ in_rtqkill(struct radix_node *rn, void *rock)
 					    rt->rt_rmx.rmx_expire);
 		}
 	}
+	RT_UNLOCK(rt);
 
 	return 0;
 }