Index: netinet/sctp_output.c
===================================================================
--- netinet/sctp_output.c	(revision 228954)
+++ netinet/sctp_output.c	(working copy)
@@ -13797,8 +13797,7 @@
 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6);
 
 	/* search installed gateway from prefix entry */
-	for (pfxrtr = pfx->ndpr_advrtrs.lh_first; pfxrtr; pfxrtr =
-	    pfxrtr->pfr_next) {
+	LIST_FOREACH(pfxrtr, &pfx->ndpr_advrtrs, pfr_entry) {
 		memset(&gw6, 0, sizeof(struct sockaddr_in6));
 		gw6.sin6_family = AF_INET6;
 		gw6.sin6_len = sizeof(struct sockaddr_in6);
Index: netinet6/in6_ifattach.c
===================================================================
--- netinet6/in6_ifattach.c	(revision 228954)
+++ netinet6/in6_ifattach.c	(working copy)
@@ -405,7 +405,7 @@
 
 	/* next, try to get it from some other hardware interface */
 	IFNET_RLOCK_NOSLEEP();
-	for (ifp = V_ifnet.tqh_first; ifp; ifp = ifp->if_list.tqe_next) {
+	TAILQ_FOREACH(ifp, &V_ifnet, if_list) {
 		if (ifp == ifp0)
 			continue;
 		if (in6_get_hw_ifid(ifp, in6) != 0)
@@ -820,7 +820,7 @@
 		/*
 		 * leave from multicast groups we have joined for the interface
 		 */
-		while ((imm = ia->ia6_memberships.lh_first) != NULL) {
+		while ((imm = LIST_FIRST(&ia->ia6_memberships)) != NULL) {
 			LIST_REMOVE(imm, i6mm_chain);
 			in6_leavegroup(imm);
 		}
@@ -923,8 +923,7 @@
 	    V_ip6_temp_regen_advance) * hz, in6_tmpaddrtimer, curvnet);
 
 	bzero(nullbuf, sizeof(nullbuf));
-	for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
-	    ifp = TAILQ_NEXT(ifp, if_list)) {
+	TAILQ_FOREACH(ifp, &V_ifnet, if_list) {
 		ndi = ND_IFINFO(ifp);
 		if (bcmp(ndi->randomid, nullbuf, sizeof(nullbuf)) != 0) {
 			/*
Index: netinet6/icmp6.c
===================================================================
--- netinet6/icmp6.c	(revision 228954)
+++ netinet6/icmp6.c	(working copy)
@@ -1780,7 +1780,7 @@
 	}
 
 	IFNET_RLOCK_NOSLEEP();
-	for (ifp = TAILQ_FIRST(&V_ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
+	TAILQ_FOREACH(ifp, &V_ifnet, if_list) {
 		addrsofif = 0;
 		IF_ADDR_LOCK(ifp);
 		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
Index: netinet6/nd6.c
===================================================================
--- netinet6/nd6.c	(revision 228954)
+++ netinet6/nd6.c	(working copy)
@@ -572,8 +572,8 @@
 {
 	CURVNET_SET((struct vnet *) arg);
 	int s;
-	struct nd_defrouter *dr;
-	struct nd_prefix *pr;
+	struct nd_defrouter *dr, *ndr;
+	struct nd_prefix *pr, *npr;
 	struct in6_ifaddr *ia6, *nia6;
 	struct in6_addrlifetime *lt6;
 
@@ -582,16 +582,9 @@
 
 	/* expire default router list */
 	s = splnet();
-	dr = TAILQ_FIRST(&V_nd_defrouter);
-	while (dr) {
-		if (dr->expire && dr->expire < time_second) {
-			struct nd_defrouter *t;
-			t = TAILQ_NEXT(dr, dr_entry);
+	TAILQ_FOREACH_SAFE(dr, &V_nd_defrouter, dr_entry, ndr) {
+		if (dr->expire && dr->expire < time_second)
 			defrtrlist_del(dr);
-			dr = t;
-		} else {
-			dr = TAILQ_NEXT(dr, dr_entry);
-		}
 	}
 
 	/*
@@ -668,8 +661,7 @@
 	}
 
 	/* expire prefix list */
-	pr = V_nd_prefix.lh_first;
-	while (pr) {
+	LIST_FOREACH_SAFE(pr, &V_nd_prefix, ndpr_entry, npr) {
 		/*
 		 * check prefix lifetime.
 		 * since pltime is just for autoconf, pltime processing for
@@ -677,18 +669,13 @@
 		 */
 		if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
 		    time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) {
-			struct nd_prefix *t;
-			t = pr->ndpr_next;
 
 			/*
 			 * address expiration and prefix expiration are
 			 * separate.  NEVER perform in6_purgeaddr here.
 			 */
-
 			prelist_remove(pr);
-			pr = t;
-		} else
-			pr = pr->ndpr_next;
+		}
 	}
 	splx(s);
 	CURVNET_RESTORE();
@@ -781,8 +768,7 @@
 	 * in the routing table, in order to keep additional side effects as
 	 * small as possible.
 	 */
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
-		ndr = TAILQ_NEXT(dr, dr_entry);
+	TAILQ_FOREACH_SAFE(dr, &V_nd_defrouter, dr_entry, ndr) {
 		if (dr->installed)
 			continue;
 
@@ -790,8 +776,7 @@
 			defrtrlist_del(dr);
 	}
 
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
-		ndr = TAILQ_NEXT(dr, dr_entry);
+	TAILQ_FOREACH_SAFE(dr, &V_nd_defrouter, dr_entry, ndr) {
 		if (!dr->installed)
 			continue;
 
@@ -800,8 +785,7 @@
 	}
 
 	/* Nuke prefix list entries toward ifp */
-	for (pr = V_nd_prefix.lh_first; pr; pr = npr) {
-		npr = pr->ndpr_next;
+	LIST_FOREACH_SAFE(pr, &V_nd_prefix, ndpr_entry, npr) {
 		if (pr->ndpr_ifp == ifp) {
 			/*
 			 * Because if_detach() does *not* release prefixes
@@ -912,7 +896,7 @@
 	 * If the address matches one of our on-link prefixes, it should be a
 	 * neighbor.
 	 */
-	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+	LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 		if (pr->ndpr_ifp != ifp)
 			continue;
 
@@ -962,7 +946,7 @@
 	 * as on-link, and thus, as a neighbor.
 	 */
 	if (ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV &&
-	    TAILQ_FIRST(&V_nd_defrouter) == NULL &&
+	    TAILQ_EMPTY(&V_nd_defrouter) &&
 	    V_nd6_defifindex == ifp->if_index) {
 		return (1);
 	}
@@ -1234,8 +1218,9 @@
 		 */
 		bzero(drl, sizeof(*drl));
 		s = splnet();
-		dr = TAILQ_FIRST(&V_nd_defrouter);
-		while (dr && i < DRLSTSIZ) {
+		TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry) {
+			if (i >= DRLSTSIZ)
+				break;
 			drl->defrouter[i].rtaddr = dr->rtaddr;
 			in6_clearscope(&drl->defrouter[i].rtaddr);
 
@@ -1244,7 +1229,6 @@
 			drl->defrouter[i].expire = dr->expire;
 			drl->defrouter[i].if_index = dr->ifp->if_index;
 			i++;
-			dr = TAILQ_NEXT(dr, dr_entry);
 		}
 		splx(s);
 		break;
@@ -1263,11 +1247,12 @@
 		 */
 		bzero(oprl, sizeof(*oprl));
 		s = splnet();
-		pr = V_nd_prefix.lh_first;
-		while (pr && i < PRLSTSIZ) {
+		LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 			struct nd_pfxrouter *pfr;
 			int j;
 
+			if (i >= PRLSTSIZ)
+				break;
 			oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
 			oprl->prefix[i].raflags = pr->ndpr_raf;
 			oprl->prefix[i].prefixlen = pr->ndpr_plen;
@@ -1292,9 +1277,8 @@
 					oprl->prefix[i].expire = maxexpire;
 			}
 
-			pfr = pr->ndpr_advrtrs.lh_first;
 			j = 0;
-			while (pfr) {
+			LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
 				if (j < DRLSTSIZ) {
 #define RTRADDR oprl->prefix[i].advrtr[j]
 					RTRADDR = pfr->router->rtaddr;
@@ -1302,13 +1286,11 @@
 #undef RTRADDR
 				}
 				j++;
-				pfr = pfr->pfr_next;
 			}
 			oprl->prefix[i].advrtrs = j;
 			oprl->prefix[i].origin = PR_ORIG_RA;
 
 			i++;
-			pr = pr->ndpr_next;
 		}
 		splx(s);
 
@@ -1470,11 +1452,9 @@
 		struct nd_prefix *pr, *next;
 
 		s = splnet();
-		for (pr = V_nd_prefix.lh_first; pr; pr = next) {
+		LIST_FOREACH_SAFE(pr, &V_nd_prefix, ndpr_entry, next) {
 			struct in6_ifaddr *ia, *ia_next;
 
-			next = pr->ndpr_next;
-
 			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
 				continue; /* XXX */
 
@@ -1500,8 +1480,7 @@
 
 		s = splnet();
 		defrouter_reset();
-		for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = next) {
-			next = TAILQ_NEXT(dr, dr_entry);
+		TAILQ_FOREACH_SAFE(dr, &V_nd_defrouter, dr_entry, next) {
 			defrtrlist_del(dr);
 		}
 		defrouter_select();
@@ -1824,8 +1803,7 @@
 	callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
 	    nd6_slowtimo, curvnet);
 	IFNET_RLOCK_NOSLEEP();
-	for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
-	    ifp = TAILQ_NEXT(ifp, if_list)) {
+	TAILQ_FOREACH(ifp, &V_ifnet, if_list) {
 		nd6if = ND_IFINFO(ifp);
 		if (nd6if->basereachable && /* already initialized */
 		    (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
@@ -2294,8 +2272,7 @@
 		return EPERM;
 	error = 0;
 
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
-	     dr = TAILQ_NEXT(dr, dr_entry)) {
+	TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry) {
 		d = (struct in6_defrouter *)buf;
 		de = (struct in6_defrouter *)(buf + sizeof(buf));
 
@@ -2335,7 +2312,7 @@
 		return EPERM;
 	error = 0;
 
-	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+	LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 		u_short advrtrs;
 		size_t advance;
 		struct sockaddr_in6 *sin6, *s6;
@@ -2380,8 +2357,7 @@
 			p->flags = pr->ndpr_stateflags;
 			p->origin = PR_ORIG_RA;
 			advrtrs = 0;
-			for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
-			     pfr = pfr->pfr_next) {
+			LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
 				if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
 					advrtrs++;
 					continue;
Index: netinet6/in6.c
===================================================================
--- netinet6/in6.c	(revision 228954)
+++ netinet6/in6.c	(working copy)
@@ -1369,7 +1369,7 @@
 	/*
 	 * leave from multicast groups we have joined for the interface
 	 */
-	while ((imm = ia->ia6_memberships.lh_first) != NULL) {
+	while ((imm = LIST_FIRST(&ia->ia6_memberships)) != NULL) {
 		LIST_REMOVE(imm, i6mm_chain);
 		in6_leavegroup(imm);
 	}
@@ -2353,8 +2353,7 @@
 	struct ifnet *ifp;
 
 	IFNET_RLOCK_NOSLEEP();
-	for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
-	    ifp = TAILQ_NEXT(ifp, if_list)) {
+	TAILQ_FOREACH(ifp, &V_ifnet, if_list) {
 		/* this function can be called during ifnet initialization */
 		if (!ifp->if_afdata[AF_INET6])
 			continue;
Index: netinet6/nd6.h
===================================================================
--- netinet6/nd6.h	(revision 228954)
+++ netinet6/nd6.h	(working copy)
@@ -278,8 +278,6 @@
 	int	ndpr_refcnt;	/* reference couter from addresses */
 };
 
-#define ndpr_next		ndpr_entry.le_next
-
 #define ndpr_raf		ndpr_flags
 #define ndpr_raf_onlink		ndpr_flags.onlink
 #define ndpr_raf_auto		ndpr_flags.autonomous
@@ -313,7 +311,6 @@
 
 struct nd_pfxrouter {
 	LIST_ENTRY(nd_pfxrouter) pfr_entry;
-#define pfr_next pfr_entry.le_next
 	struct nd_defrouter *router;
 };
 
Index: netinet6/nd6_rtr.c
===================================================================
--- netinet6/nd6_rtr.c	(revision 228954)
+++ netinet6/nd6_rtr.c	(working copy)
@@ -501,8 +501,7 @@
 {
 	struct nd_defrouter *dr;
 
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
-	     dr = TAILQ_NEXT(dr, dr_entry)) {
+	TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry) {
 		if (dr->ifp == ifp && IN6_ARE_ADDR_EQUAL(addr, &dr->rtaddr))
 			return (dr);
 	}
@@ -549,8 +548,7 @@
 {
 	struct nd_defrouter *dr;
 
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
-	     dr = TAILQ_NEXT(dr, dr_entry))
+	TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry)
 		defrouter_delreq(dr);
 
 	/*
@@ -581,7 +579,7 @@
 	/*
 	 * Also delete all the pointers to the router in each prefix lists.
 	 */
-	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+	LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 		struct nd_pfxrouter *pfxrtr;
 		if ((pfxrtr = pfxrtr_lookup(pr, dr)) != NULL)
 			pfxrtr_del(pfxrtr);
@@ -631,7 +629,7 @@
 	 * Let's handle easy case (3) first:
 	 * If default router list is empty, there's nothing to be done.
 	 */
-	if (!TAILQ_FIRST(&V_nd_defrouter)) {
+	if (TAILQ_EMPTY(&V_nd_defrouter)) {
 		splx(s);
 		return;
 	}
@@ -641,8 +639,7 @@
 	 * We just pick up the first reachable one (if any), assuming that
 	 * the ordering rule of the list described in defrtrlist_update().
 	 */
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
-	     dr = TAILQ_NEXT(dr, dr_entry)) {
+	TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry) {
 		IF_AFDATA_LOCK(dr->ifp);
 		if (selected_dr == NULL &&
 		    (ln = nd6_lookup(&dr->rtaddr, 0, dr->ifp)) &&
@@ -799,8 +796,7 @@
 	 */
 
 	/* insert at the end of the group */
-	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
-	     dr = TAILQ_NEXT(dr, dr_entry)) {
+	TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry) {
 		if (rtpref(n) > rtpref(dr))
 			break;
 	}
@@ -821,7 +817,7 @@
 {
 	struct nd_pfxrouter *search;
 
-	for (search = pr->ndpr_advrtrs.lh_first; search; search = search->pfr_next) {
+	LIST_FOREACH(search, &pr->ndpr_advrtrs, pfr_entry) {
 		if (search->router == dr)
 			break;
 	}
@@ -857,8 +853,7 @@
 {
 	struct nd_prefix *search;
 
-	for (search = V_nd_prefix.lh_first;
-	    search; search = search->ndpr_next) {
+	LIST_FOREACH(search, &V_nd_prefix, ndpr_entry) {
 		if (key->ndpr_ifp == search->ndpr_ifp &&
 		    key->ndpr_plen == search->ndpr_plen &&
 		    in6_are_prefix_equal(&key->ndpr_prefix.sin6_addr,
@@ -964,9 +959,7 @@
 	LIST_REMOVE(pr, ndpr_entry);
 
 	/* free list of routers that adversed the prefix */
-	for (pfr = pr->ndpr_advrtrs.lh_first; pfr; pfr = next) {
-		next = pfr->pfr_next;
-
+	LIST_FOREACH_SAFE(pfr, &pr->ndpr_advrtrs, pfr_entry, next) {
 		free(pfr, M_IP6NDP);
 	}
 	splx(s);
@@ -1329,8 +1322,7 @@
 	struct llentry *ln;
 	int canreach;
 
-	for (pfxrtr = LIST_FIRST(&pr->ndpr_advrtrs); pfxrtr != NULL;
-	     pfxrtr = LIST_NEXT(pfxrtr, pfr_entry)) {
+	LIST_FOREACH(pfxrtr, &pr->ndpr_advrtrs, pfr_entry) {
 		IF_AFDATA_LOCK(pfxrtr->router->ifp);
 		ln = nd6_lookup(&pfxrtr->router->rtaddr, 0, pfxrtr->router->ifp);
 		IF_AFDATA_UNLOCK(pfxrtr->router->ifp);
@@ -1369,7 +1361,7 @@
 	 * Check if there is a prefix that has a reachable advertising
 	 * router.
 	 */
-	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+	LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 		if (pr->ndpr_raf_onlink && find_pfxlist_reachable_router(pr))
 			break;
 	}
@@ -1379,12 +1371,10 @@
 	 * that does not advertise any prefixes.
 	 */
 	if (pr == NULL) {
-		for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
-		    dr = TAILQ_NEXT(dr, dr_entry)) {
+		TAILQ_FOREACH(dr, &V_nd_defrouter, dr_entry) {
 			struct nd_prefix *pr0;
 
-			for (pr0 = V_nd_prefix.lh_first; pr0;
-			    pr0 = pr0->ndpr_next) {
+			LIST_FOREACH(pr0, &V_nd_prefix, ndpr_entry) {
 				if ((pfxrtr = pfxrtr_lookup(pr0, dr)) != NULL)
 					break;
 			}
@@ -1392,7 +1382,7 @@
 				break;
 		}
 	}
-	if (pr != NULL || (TAILQ_FIRST(&V_nd_defrouter) && pfxrtr == NULL)) {
+	if (pr != NULL || (!TAILQ_EMPTY(&V_nd_defrouter) && pfxrtr == NULL)) {
 		/*
 		 * There is at least one prefix that has a reachable router,
 		 * or at least a router which probably does not advertise
@@ -1402,7 +1392,7 @@
 		 * Detach prefixes which have no reachable advertising
 		 * router, and attach other prefixes.
 		 */
-		for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+		LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 			/* XXX: a link-local prefix should never be detached */
 			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
 				continue;
@@ -1426,7 +1416,7 @@
 		}
 	} else {
 		/* there is no prefix that has a reachable router */
-		for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+		LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
 				continue;
 
@@ -1449,7 +1439,7 @@
 	 * interfaces.  Such cases will be handled in nd6_prefix_onlink,
 	 * so we don't have to care about them.
 	 */
-	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+	LIST_FOREACH(pr, &V_nd_prefix, ndpr_entry) {
 		int e;
 		char ip6buf[INET6_ADDRSTRLEN];
 
@@ -1577,7 +1567,7 @@
 	 * Although such a configuration is expected to be rare, we explicitly
 	 * allow it.
 	 */
-	for (opr = V_nd_prefix.lh_first; opr; opr = opr->ndpr_next) {
+	LIST_FOREACH(opr, &V_nd_prefix, ndpr_entry) {
 		if (opr == pr)
 			continue;
 
@@ -1716,7 +1706,7 @@
 		 * If there's one, try to make the prefix on-link on the
 		 * interface.
 		 */
-		for (opr = V_nd_prefix.lh_first; opr; opr = opr->ndpr_next) {
+		LIST_FOREACH(opr, &V_nd_prefix, ndpr_entry) {
 			if (opr == pr)
 				continue;