Index: in_rmx.c
===================================================================
--- in_rmx.c	(revision 208681)
+++ in_rmx.c	(working copy)
@@ -121,12 +121,12 @@
 	struct radix_node *rn = rn_match(v_arg, head);
 	struct rtentry *rt = (struct rtentry *)rn;
 
-	/*XXX locking? */
-	if (rt && rt->rt_refcnt == 0) {		/* this is first reference */
-		if (rt->rt_flags & RTPRF_OURS) {
-			rt->rt_flags &= ~RTPRF_OURS;
-			rt->rt_rmx.rmx_expire = 0;
-		}
+	if (rt && rt->rt_refcnt == 0 &&	/* this is first reference */
+	    rt->rt_flags & RTPRF_OURS) {
+		RT_LOCK(rt);
+		rt->rt_flags &= ~RTPRF_OURS;
+		rt->rt_rmx.rmx_expire = 0;
+		RT_UNLOCK(rt);
 	}
 	return rn;
 }
@@ -206,6 +206,7 @@
 
 	RADIX_NODE_HEAD_WLOCK_ASSERT(ap->rnh);
 
+	RT_LOCK(rt);
 	if (rt->rt_flags & RTPRF_OURS) {
 		ap->found++;
 
@@ -234,6 +235,7 @@
 					    rt->rt_rmx.rmx_expire);
 		}
 	}
+	RT_UNLOCK(rt);
 
 	return 0;
 }