Fix a route table leak in rtalloc() and rtalloc_ign().  It is possible for ro->ro_rt to be non-NULL even though the RTF_UP flag is cleared.  (Example: a routing daemon or the "route" command deletes a cloned route in active use by a TCP connection.)  In that case, the code was clobbering a reference to the routing table entry without decrementing the entry's reference count.
Fix a route table leak in rtalloc() and rtalloc_ign().  It is
possible for ro->ro_rt to be non-NULL even though the RTF_UP flag
is cleared.  (Example: a routing daemon or the "route" command
deletes a cloned route in active use by a TCP connection.)  In that
case, the code was clobbering a reference to the routing table
entry without decrementing the entry's reference count.

The splnet() call probably isn't needed, but I haven't been able
to prove that yet.  It isn't significant from a performance standpoint
since it is executed very rarely.

Reviewed by:	wollman and others in the freebsd-current mailing list

jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase,jrobhoward/SCADAbase