X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/3903760236c30e3b5ace7a4eefac3a269d68957c..c3c9b80d004dbbfdf763edeb97968c6997e3b45b:/bsd/netinet6/icmp6.c

diff --git a/bsd/netinet6/icmp6.c b/bsd/netinet6/icmp6.c
index cc5f1af53..6e276598c 100644
--- a/bsd/netinet6/icmp6.c
+++ b/bsd/netinet6/icmp6.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000-2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
@@ -148,6 +148,7 @@ struct icmp6stat icmp6stat;
 
 extern struct inpcbhead ripcb;
 extern int icmp6errppslim;
+extern int icmp6errppslim_random_incr;
 extern int icmp6rappslim;
 static int icmp6errpps_count = 0;
 static int icmp6rapps_count = 0;
@@ -160,14 +161,14 @@ static void icmp6_errcount(struct icmp6errstat *, int, int);
 static int icmp6_rip6_input(struct mbuf **, int);
 static int icmp6_ratelimit(const struct in6_addr *, const int, const int);
 static const char *icmp6_redirect_diag(struct in6_addr *,
-	struct in6_addr *, struct in6_addr *);
+    struct in6_addr *, struct in6_addr *);
 static struct mbuf *ni6_input(struct mbuf *, int);
-static struct mbuf *ni6_nametodns(const char *, int, int);
+static struct mbuf *ni6_nametodns(const char *, uint32_t, int);
 static int ni6_dnsmatch(const char *, int, const char *, int);
-static int ni6_addrs(struct icmp6_nodeinfo *, 
-			  struct ifnet **, char *);
+static int ni6_addrs(struct icmp6_nodeinfo *,
+    struct ifnet **, char *);
 static int ni6_store_addrs(struct icmp6_nodeinfo *, struct icmp6_nodeinfo *,
-				struct ifnet *, int);
+    struct ifnet *, int);
 static int icmp6_notify_error(struct mbuf *, int, int, int);
 
 
@@ -180,12 +181,17 @@ icmp6_init(struct ip6protosw *pp, struct domain *dp)
 
 	/* Also called from ip6_init() without pp */
 	VERIFY(pp == NULL ||
-	    (pp->pr_flags & (PR_INITIALIZED|PR_ATTACHED)) == PR_ATTACHED);
+	    (pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
 
 	/* This gets called by more than one protocols, so initialize once */
 	if (!icmp6_initialized) {
 		icmp6_initialized = 1;
 		mld_init();
+		if (icmp6errppslim >= 0 &&
+		    icmp6errppslim_random_incr > 0 &&
+		    icmp6errppslim <= INT32_MAX - (icmp6errppslim_random_incr + 1)) {
+			icmp6errppslim += (random() % icmp6errppslim_random_incr) + 1;
+		}
 	}
 }
 
@@ -255,25 +261,29 @@ icmp6_error2(struct mbuf *m, int type, int code, int param,
 {
 	struct ip6_hdr *ip6;
 
-	if (ifp == NULL)
+	if (ifp == NULL) {
 		return;
+	}
 
 #ifndef PULLDOWN_TEST
-	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr),return );
+	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return );
 #else
 	if (m->m_len < sizeof(struct ip6_hdr)) {
 		m = m_pullup(m, sizeof(struct ip6_hdr));
-		if (m == NULL)
+		if (m == NULL) {
 			return;
+		}
 	}
 #endif
 
 	ip6 = mtod(m, struct ip6_hdr *);
 
-	if (in6_setscope(&ip6->ip6_src, ifp, NULL) != 0)
+	if (in6_setscope(&ip6->ip6_src, ifp, NULL) != 0) {
 		return;
-	if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0)
+	}
+	if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) {
 		return;
+	}
 
 	icmp6_error(m, type, code, param);
 }
@@ -282,24 +292,25 @@ icmp6_error2(struct mbuf *m, int type, int code, int param,
  * Generate an error packet of type error in response to bad IP6 packet.
  */
 void
-icmp6_error(struct mbuf *m, int type, int code, int param) {
+icmp6_error(struct mbuf *m, int type, int code, int param)
+{
 	icmp6_error_flag(m, type, code, param, ICMP6_ERROR_RST_MRCVIF);
 }
 
-void icmp6_error_flag (struct mbuf *m, int type, int code, int param, int flags)
+void
+icmp6_error_flag(struct mbuf *m, int type, int code, int param, int flags)
 {
 	struct ip6_hdr *oip6, *nip6;
 	struct icmp6_hdr *icmp6;
 	u_int preplen;
 	int off;
-	int nxt;
 
 	icmp6stat.icp6s_error++;
 
 	/* count per-type-code statistics */
 	icmp6_errcount(&icmp6stat.icp6s_outerrhist, type, code);
 
-#ifdef M_DECRYPTED	/*not openbsd*/
+#ifdef M_DECRYPTED      /*not openbsd*/
 	if (m->m_flags & M_DECRYPTED) {
 		icmp6stat.icp6s_canterror++;
 		goto freeit;
@@ -307,12 +318,13 @@ void icmp6_error_flag (struct mbuf *m, int type, int code, int param, int flags)
 #endif
 
 #ifndef PULLDOWN_TEST
-	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return);
+	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return );
 #else
 	if (m->m_len < sizeof(struct ip6_hdr)) {
 		m = m_pullup(m, sizeof(struct ip6_hdr));
-		if (m == NULL)
+		if (m == NULL) {
 			return;
+		}
 	}
 #endif
 	oip6 = mtod(m, struct ip6_hdr *);
@@ -328,55 +340,67 @@ void icmp6_error_flag (struct mbuf *m, int type, int code, int param, int flags)
 	 *   in the option type field.  This check has been done in
 	 *   ip6_unknown_opt(), so we can just check the type and code.
 	 */
-	if ((m->m_flags & (M_BCAST|M_MCAST) ||
-	     IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
+	if ((m->m_flags & (M_BCAST | M_MCAST) ||
+	    IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
 	    (type != ICMP6_PACKET_TOO_BIG &&
-	     (type != ICMP6_PARAM_PROB ||
-	      code != ICMP6_PARAMPROB_OPTION)))
+	    (type != ICMP6_PARAM_PROB ||
+	    code != ICMP6_PARAMPROB_OPTION))) {
 		goto freeit;
+	}
 
 	/*
 	 * RFC 2463, 2.4 (e.5): source address check.
 	 * XXX: the case of anycast source?
 	 */
 	if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
-	    IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
+	    IN6_IS_ADDR_MULTICAST(&oip6->ip6_src)) {
 		goto freeit;
+	}
 
 	/*
 	 * If we are about to send ICMPv6 against ICMPv6 error/redirect,
 	 * don't do it.
+	 *
+	 * We want to check for that for all ICMP error types, other than
+	 * ICMP6_PARAM_PROB when it is being sent in response of first frag
+	 * with incomplete header.
+	 * That also includes the case when the first frag has incomplete ICMPv6
+	 * header. The check below in that case would fail the IP6_EXTHDR_CHECK
+	 * and would otherwise prevent us from sending the error back.
 	 */
-	nxt = -1;
-	off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
-	if (off >= 0 && nxt == IPPROTO_ICMPV6) {
-		struct icmp6_hdr *icp;
+	if (type != ICMP6_PARAM_PROB ||
+	    code != ICMP6_PARAMPROB_FIRSTFRAG_INCOMP_HDR) {
+		int nxt = -1;
+		off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
+		if (off >= 0 && nxt == IPPROTO_ICMPV6) {
+			struct icmp6_hdr *icp;
 
 #ifndef PULLDOWN_TEST
-		IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), return);
-		icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
+			IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), return );
+			icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
-		IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
-			sizeof(*icp));
-		if (icp == NULL) {
-			icmp6stat.icp6s_tooshort++;
-			return;
-		}
+			IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
+			    sizeof(*icp));
+			if (icp == NULL) {
+				icmp6stat.icp6s_tooshort++;
+				return;
+			}
 #endif
-		if (icp->icmp6_type < ICMP6_ECHO_REQUEST ||
-		    icp->icmp6_type == ND_REDIRECT) {
-			/*
-			 * ICMPv6 error
-			 * Special case: for redirect (which is
-			 * informational) we must not send icmp6 error.
-			 */
-			icmp6stat.icp6s_canterror++;
-			goto freeit;
+			if (icp->icmp6_type < ICMP6_ECHO_REQUEST ||
+			    icp->icmp6_type == ND_REDIRECT) {
+				/*
+				 * ICMPv6 error
+				 * Special case: for redirect (which is
+				 * informational) we must not send icmp6 error.
+				 */
+				icmp6stat.icp6s_canterror++;
+				goto freeit;
+			} else {
+				/* ICMPv6 informational - send the error */
+			}
 		} else {
-			/* ICMPv6 informational - send the error */
+			/* non-ICMPv6 - send the error */
 		}
-	} else {
-		/* non-ICMPv6 - send the error */
 	}
 
 	oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
@@ -391,15 +415,17 @@ void icmp6_error_flag (struct mbuf *m, int type, int code, int param, int flags)
 	 * OK, ICMP6 can be generated.
 	 */
 
-	if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
+	if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN) {
 		m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
+	}
 
 	preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
 	M_PREPEND(m, preplen, M_DONTWAIT, 1);
-	if (m && m->m_len < preplen)
+	if (m && m->m_len < preplen) {
 		m = m_pullup(m, preplen);
+	}
 	if (m == NULL) {
-		nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__));
+		nd6log(debug, "ENOBUFS in icmp6_error %d\n", __LINE__);
 		return;
 	}
 
@@ -411,8 +437,8 @@ void icmp6_error_flag (struct mbuf *m, int type, int code, int param, int flags)
 	in6_clearscope(&oip6->ip6_dst);
 
 	icmp6 = (struct icmp6_hdr *)(nip6 + 1);
-	icmp6->icmp6_type = type;
-	icmp6->icmp6_code = code;
+	icmp6->icmp6_type = (uint8_t)type;
+	icmp6->icmp6_code = (uint8_t)code;
 	icmp6->icmp6_pptr = htonl((u_int32_t)param);
 
 	/*
@@ -431,7 +457,7 @@ void icmp6_error_flag (struct mbuf *m, int type, int code, int param, int flags)
 
 	return;
 
-  freeit:
+freeit:
 	/*
 	 * If we can't tell whether or not we can generate ICMP6, free it.
 	 */
@@ -514,7 +540,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 	 * Note: SSM filters are not applied for ICMPv6 traffic.
 	 */
 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
-		struct in6_multi	*inm;
+		struct in6_multi        *inm;
 
 		in6_multihead_lock_shared();
 		IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, inm);
@@ -540,9 +566,9 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 	 * calculate the checksum
 	 */
 	if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
-		nd6log((LOG_ERR,
+		nd6log(error,
 		    "ICMP6 checksum error(%d|%x) %s\n",
-		    icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src)));
+		    icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src));
 		icmp6stat.icp6s_checksum++;
 		goto freeit;
 	}
@@ -566,23 +592,22 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
 	icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg);
-	if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK)
+	if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK) {
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error);
+	}
 
 	switch (icmp6->icmp6_type) {
 	case ICMP6_DST_UNREACH:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach);
 		switch (code) {
 		case ICMP6_DST_UNREACH_NOROUTE:
+		case ICMP6_DST_UNREACH_ADDR:    /* PRC_HOSTDEAD is a DOS */
 			code = PRC_UNREACH_NET;
 			break;
 		case ICMP6_DST_UNREACH_ADMIN:
 			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib);
 			code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
 			break;
-		case ICMP6_DST_UNREACH_ADDR:
-			code = PRC_HOSTDEAD;
-			break;
 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
 			/* I mean "source address was incorrect." */
 			code = PRC_PARAMPROB;
@@ -597,6 +622,10 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ICMP6_PACKET_TOO_BIG:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);
+		if (ntohl(icmp6->icmp6_mtu) < IPV6_MMTU) {
+			icmp6stat.icp6s_badpkttoobig++;
+			goto freeit;
+		}
 
 		code = PRC_MSGSIZE;
 
@@ -637,15 +666,16 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ICMP6_ECHO_REQUEST:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
+		}
 
 		if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
 			/* Give up remote */
 			goto rate_limit_checked;
 		}
 		if ((n->m_flags & M_EXT) != 0
-		 || n->m_len < off + sizeof(struct icmp6_hdr)) {
+		    || n->m_len < off + sizeof(struct icmp6_hdr)) {
 			struct mbuf *n0 = n;
 			const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
 
@@ -658,7 +688,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 				m_freem(n0);
 				goto rate_limit_checked;
 			}
-			MGETHDR(n, M_DONTWAIT, n0->m_type);	/* MAC-OK */
+			MGETHDR(n, M_DONTWAIT, n0->m_type);     /* MAC-OK */
 			if (n && maxlen >= MHLEN) {
 				MCLGET(n, M_DONTWAIT);
 				if ((n->m_flags & M_EXT) == 0) {
@@ -681,7 +711,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
 			noff = sizeof(struct ip6_hdr);
 			n->m_pkthdr.len = n->m_len =
-				noff + sizeof(struct icmp6_hdr);
+			    noff + sizeof(struct icmp6_hdr);
 			/*
 			 * Adjust mbuf. ip6_plen will be adjusted in
 			 * ip6_output().
@@ -693,12 +723,12 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		} else {
 			nip6 = mtod(n, struct ip6_hdr *);
 			IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off,
-				sizeof(*nicmp6));
+			    sizeof(*nicmp6));
 			noff = off;
 		}
-		if(nicmp6 == NULL)
+		if (nicmp6 == NULL) {
 			panic("nicmp6 is NULL in %s, which isn't good!\n", __FUNCTION__);
-		else {
+		} else {
 			nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
 			nicmp6->icmp6_code = 0;
 		}
@@ -711,62 +741,72 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ICMP6_ECHO_REPLY:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
+		}
 		break;
 
 	case MLD_LISTENER_QUERY:
 	case MLD_LISTENER_REPORT:
 
-		if (icmp6len < sizeof(struct mld_hdr))
+		if (icmp6len < sizeof(struct mld_hdr)) {
 			goto badlen;
-		if (icmp6->icmp6_type == MLD_LISTENER_QUERY) /* XXX: ugly... */
+		}
+		if (icmp6->icmp6_type == MLD_LISTENER_QUERY) { /* XXX: ugly... */
 			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery);
-		else
+		} else {
 			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport);
+		}
 
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
 			/* give up local */
-			if (mld_input(m, off, icmp6len) == IPPROTO_DONE)
+			if (mld_input(m, off, icmp6len) == IPPROTO_DONE) {
 				m = NULL;
+			}
 			goto freeit;
 		}
-		if (mld_input(n, off, icmp6len) != IPPROTO_DONE)
+		if (mld_input(n, off, icmp6len) != IPPROTO_DONE) {
 			m_freem(n);
+		}
 		/* m stays. */
 		goto rate_limit_checked;
 
 	case MLD_LISTENER_DONE:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone);
-		if (icmp6len < sizeof(struct mld_hdr))	/* necessary? */
+		if (icmp6len < sizeof(struct mld_hdr)) { /* necessary? */
 			goto badlen;
-		break;		/* nothing to be done in kernel */
+		}
+		break;          /* nothing to be done in kernel */
 
 	case MLD_MTRACE_RESP:
 	case MLD_MTRACE:
 		/* XXX: these two are experimental.  not officially defined. */
 		/* XXX: per-interface statistics? */
-		break;		/* just pass it to applications */
+		break;          /* just pass it to applications */
 
 	case ICMP6_NI_QUERY:
-		if (!icmp6_nodeinfo)
+		if (!icmp6_nodeinfo) {
 			break;
+		}
 //### LD 10/20 Check fbsd differences here. Not sure we're more advanced or not.
-		/* By RFC 4620 refuse to answer queries from global scope addresses */ 
-		if ((icmp6_nodeinfo & 8) != 8 && in6_addrscope(&ip6->ip6_src) == IPV6_ADDR_SCOPE_GLOBAL)
+		/* By RFC 4620 refuse to answer queries from global scope addresses */
+		if ((icmp6_nodeinfo & 8) != 8 && in6_addrscope(&ip6->ip6_src) == IPV6_ADDR_SCOPE_GLOBAL) {
 			break;
+		}
 
-		if (icmp6len < sizeof(struct icmp6_nodeinfo))
+		if (icmp6len < sizeof(struct icmp6_nodeinfo)) {
 			goto badlen;
+		}
 
 #ifndef PULLDOWN_TEST
 		IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),
-				 return IPPROTO_DONE);
+		    return IPPROTO_DONE);
 #endif
 
 		n = m_copy(m, 0, M_COPYALL);
-		if (n)
+		if (n) {
 			n = ni6_input(n, off);
+		}
 		if (n) {
 			noff = sizeof(struct ip6_hdr);
 			icmp6stat.icp6s_reflect++;
@@ -776,16 +816,19 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		goto rate_limit_checked;
 
 	case ICMP6_WRUREPLY:
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
+		}
 		break;
 
 	case ND_ROUTER_SOLICIT:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
-		if (icmp6len < sizeof(struct nd_router_solicit))
+		}
+		if (icmp6len < sizeof(struct nd_router_solicit)) {
 			goto badlen;
+		}
 
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
 			/* give up local */
@@ -799,10 +842,12 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ND_ROUTER_ADVERT:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
-		if (icmp6len < sizeof(struct nd_router_advert))
+		}
+		if (icmp6len < sizeof(struct nd_router_advert)) {
 			goto badlen;
+		}
 
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
 			/* give up local */
@@ -816,10 +861,12 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ND_NEIGHBOR_SOLICIT:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
-		if (icmp6len < sizeof(struct nd_neighbor_solicit))
+		}
+		if (icmp6len < sizeof(struct nd_neighbor_solicit)) {
 			goto badlen;
+		}
 
 		if (proxy ||
 		    ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL)) {
@@ -834,10 +881,12 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ND_NEIGHBOR_ADVERT:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
-		if (icmp6len < sizeof(struct nd_neighbor_advert))
+		}
+		if (icmp6len < sizeof(struct nd_neighbor_advert)) {
 			goto badlen;
+		}
 
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
 			/* give up local */
@@ -851,35 +900,39 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 
 	case ND_REDIRECT:
 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect);
-		if (code != 0)
+		if (code != 0) {
 			goto badcode;
-		if (icmp6len < sizeof(struct nd_redirect))
+		}
+		if (icmp6len < sizeof(struct nd_redirect)) {
 			goto badlen;
+		}
 
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
 			/* give up local */
-			icmp6_redirect_input(m, off);
+			icmp6_redirect_input(m, off, icmp6len);
 			m = NULL;
 			goto freeit;
 		}
-		icmp6_redirect_input(n, off);
+		icmp6_redirect_input(n, off, icmp6len);
 		/* m stays. */
 		goto rate_limit_checked;
 
 	case ICMP6_ROUTER_RENUMBERING:
 		if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
-		    code != ICMP6_ROUTER_RENUMBERING_RESULT)
+		    code != ICMP6_ROUTER_RENUMBERING_RESULT) {
 			goto badcode;
-		if (icmp6len < sizeof(struct icmp6_router_renum))
+		}
+		if (icmp6len < sizeof(struct icmp6_router_renum)) {
 			goto badlen;
+		}
 		break;
 
 	default:
-		nd6log((LOG_DEBUG,
+		nd6log(debug,
 		    "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%d)\n",
 		    icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src),
 		    ip6_sprintf(&ip6->ip6_dst),
-		    m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0));
+		    m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0);
 		if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
 			/* ICMPv6 error: MUST deliver it by spec... */
 			code = PRC_NCMDS;
@@ -888,18 +941,18 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 			/* ICMPv6 informational: MUST not deliver */
 			goto rate_limit_checked;
 		}
-	deliver:
+deliver:
 		if (icmp6_notify_error(m, off, icmp6len, code)) {
 			/* In this case, m should've been freed. */
-			return(IPPROTO_DONE);
+			return IPPROTO_DONE;
 		}
 		break;
 
-	badcode:
+badcode:
 		icmp6stat.icp6s_badcode++;
 		break;
 
-	badlen:
+badlen:
 		icmp6stat.icp6s_badlen++;
 		break;
 	}
@@ -927,27 +980,27 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 	}
 #ifndef PULLDOWN_TEST
 	IP6_EXTHDR_CHECK(m, off,
-			 sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
-			 return -1);
+	    sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
+	    return -1);
 	icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
 	IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
-		       sizeof(*icmp6) + sizeof(struct ip6_hdr));
+	    sizeof(*icmp6) + sizeof(struct ip6_hdr));
 	if (icmp6 == NULL) {
 		icmp6stat.icp6s_tooshort++;
-		return(-1);
+		return -1;
 	}
 #endif
 	eip6 = (struct ip6_hdr *)(icmp6 + 1);
+	bzero(&icmp6dst, sizeof(icmp6dst));
 
 	/* Detect the upper level protocol */
 	{
-		void (*ctlfunc)(int, struct sockaddr *, void *);
+		void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
 		u_int8_t nxt = eip6->ip6_nxt;
 		int eoff = off + sizeof(struct icmp6_hdr) +
-			sizeof(struct ip6_hdr);
+		    sizeof(struct ip6_hdr);
 		struct ip6ctlparam ip6cp;
-		struct in6_addr *finaldst = NULL;
 		int icmp6type = icmp6->icmp6_type;
 		struct ip6_frag *fh;
 		struct ip6_rthdr *rth;
@@ -962,24 +1015,24 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 			case IPPROTO_DSTOPTS:
 			case IPPROTO_AH:
 #ifndef PULLDOWN_TEST
-				IP6_EXTHDR_CHECK(m, 0, eoff +
-						 sizeof(struct ip6_ext),
-						 return -1);
+				IP6_EXTHDR_CHECK(m, 0,
+				    eoff + sizeof(struct ip6_ext), return -1);
 				eh = (struct ip6_ext *)(mtod(m, caddr_t)
-							+ eoff);
+				    + eoff);
 #else
 				IP6_EXTHDR_GET(eh, struct ip6_ext *, m,
-					       eoff, sizeof(*eh));
+				    eoff, sizeof(*eh));
 				if (eh == NULL) {
 					icmp6stat.icp6s_tooshort++;
-					return(-1);
+					return -1;
 				}
 #endif
 
-				if (nxt == IPPROTO_AH)
+				if (nxt == IPPROTO_AH) {
 					eoff += (eh->ip6e_len + 2) << 2;
-				else
+				} else {
 					eoff += (eh->ip6e_len + 1) << 3;
+				}
 				nxt = eh->ip6e_nxt;
 				break;
 			case IPPROTO_ROUTING:
@@ -993,15 +1046,15 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 				 */
 #ifndef PULLDOWN_TEST
 				IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth),
-						 return -1);
-				rth = (struct ip6_rthdr *)(mtod(m, caddr_t)
-							   + eoff);
+				    return -1);
+				rth = (struct ip6_rthdr *)
+				    (mtod(m, caddr_t) + eoff);
 #else
 				IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,
-					       eoff, sizeof(*rth));
+				    eoff, sizeof(*rth));
 				if (rth == NULL) {
 					icmp6stat.icp6s_tooshort++;
-					return(-1);
+					return -1;
 				}
 #endif
 				rthlen = (rth->ip6r_len + 1) << 3;
@@ -1019,21 +1072,22 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 
 #ifndef PULLDOWN_TEST
 					IP6_EXTHDR_CHECK(m, 0, eoff + rthlen,
-							 return -1);
+					    return -1);
 					rth0 = (struct ip6_rthdr0 *)(mtod(m, caddr_t) + eoff);
 #else
 					IP6_EXTHDR_GET(rth0,
-						       struct ip6_rthdr0 *, m,
-						       eoff, rthlen);
+					    struct ip6_rthdr0 *, m,
+					    eoff, rthlen);
 					if (rth0 == NULL) {
 						icmp6stat.icp6s_tooshort++;
-						return(-1);
+						return -1;
 					}
 #endif
 					/* just ignore a bogus header */
 					if ((rth0->ip6r0_len % 2) == 0 &&
-					    (hops = rth0->ip6r0_len/2))
-						finaldst = (struct in6_addr *)(void *)(rth0 + 1) + (hops - 1);
+					    (hops = rth0->ip6r0_len / 2)) {
+						icmp6dst.sin6_addr = *((struct in6_addr *)(void *)(rth0 + 1) + (hops - 1));
+					}
 				}
 				eoff += rthlen;
 				nxt = rth->ip6r_nxt;
@@ -1041,16 +1095,16 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 			case IPPROTO_FRAGMENT:
 #ifndef PULLDOWN_TEST
 				IP6_EXTHDR_CHECK(m, 0, eoff +
-						 sizeof(struct ip6_frag),
-						 return -1);
+				    sizeof(struct ip6_frag),
+				    return -1);
 				fh = (struct ip6_frag *)(mtod(m, caddr_t)
-							 + eoff);
+				    + eoff);
 #else
 				IP6_EXTHDR_GET(fh, struct ip6_frag *, m,
-					       eoff, sizeof(*fh));
+				    eoff, sizeof(*fh));
 				if (fh == NULL) {
 					icmp6stat.icp6s_tooshort++;
-					return (-1);
+					return -1;
 				}
 #endif
 				/*
@@ -1059,8 +1113,9 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 				 * we'll go to the notify label for path MTU
 				 * discovery.
 				 */
-				if (fh->ip6f_offlg & IP6F_OFF_MASK)
+				if (fh->ip6f_offlg & IP6F_OFF_MASK) {
 					goto notify;
+				}
 
 				eoff += sizeof(struct ip6_frag);
 				nxt = fh->ip6f_nxt;
@@ -1077,7 +1132,7 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 				goto notify;
 			}
 		}
-	  notify:
+notify:
 #ifndef PULLDOWN_TEST
 		icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
@@ -1085,7 +1140,7 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 		    sizeof(*icmp6) + sizeof(struct ip6_hdr));
 		if (icmp6 == NULL) {
 			icmp6stat.icp6s_tooshort++;
-			return (-1);
+			return -1;
 		}
 #endif
 
@@ -1099,52 +1154,55 @@ icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
 		 */
 		eip6 = (struct ip6_hdr *)(icmp6 + 1);
 
-		bzero(&icmp6dst, sizeof(icmp6dst));
 		icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
 		icmp6dst.sin6_family = AF_INET6;
-		if (finaldst == NULL)
+		if (IN6_IS_ADDR_UNSPECIFIED(&icmp6dst.sin6_addr)) {
 			icmp6dst.sin6_addr = eip6->ip6_dst;
-		else
-			icmp6dst.sin6_addr = *finaldst;
-		if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, NULL))
+		}
+		if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, NULL)) {
 			goto freeit;
+		}
 		bzero(&icmp6src, sizeof(icmp6src));
 		icmp6src.sin6_len = sizeof(struct sockaddr_in6);
 		icmp6src.sin6_family = AF_INET6;
 		icmp6src.sin6_addr = eip6->ip6_src;
-		if (in6_setscope(&icmp6src.sin6_addr, m->m_pkthdr.rcvif, NULL))
+		if (in6_setscope(&icmp6src.sin6_addr, m->m_pkthdr.rcvif, NULL)) {
 			goto freeit;
+		}
 		icmp6src.sin6_flowinfo =
 		    (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
 
-		if (finaldst == NULL)
-			finaldst = &eip6->ip6_dst;
 		ip6cp.ip6c_m = m;
 		ip6cp.ip6c_icmp6 = icmp6;
 		ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
 		ip6cp.ip6c_off = eoff;
-		ip6cp.ip6c_finaldst = finaldst;
+		ip6cp.ip6c_finaldst = &icmp6dst.sin6_addr;
 		ip6cp.ip6c_src = &icmp6src;
 		ip6cp.ip6c_nxt = nxt;
 
 		if (icmp6type == ICMP6_PACKET_TOO_BIG) {
 			notifymtu = ntohl(icmp6->icmp6_mtu);
 			ip6cp.ip6c_cmdarg = (void *)&notifymtu;
-			icmp6_mtudisc_update(&ip6cp, 1);	/*XXX*/
+			icmp6_mtudisc_update(&ip6cp, 1);        /*XXX*/
 		}
 
-		ctlfunc = (void (*)(int, struct sockaddr *, void *))
-			(ip6_protox[nxt]->pr_ctlinput);
+		ctlfunc = ip6_protox[nxt]->pr_ctlinput;
 		if (ctlfunc) {
+			LCK_MTX_ASSERT(inet6_domain_mutex, LCK_MTX_ASSERT_OWNED);
+
+			lck_mtx_unlock(inet6_domain_mutex);
+
 			(void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst,
-					  &ip6cp);
+			    &ip6cp, m->m_pkthdr.rcvif);
+
+			lck_mtx_lock(inet6_domain_mutex);
 		}
 	}
-	return(0);
+	return 0;
 
 freeit:
 	m_freem(m);
-	return(-1);
+	return -1;
 }
 
 void
@@ -1152,7 +1210,7 @@ icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
 {
 	struct in6_addr *dst = ip6cp->ip6c_finaldst;
 	struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;
-	struct mbuf *m = ip6cp->ip6c_m;	/* will be necessary for scope issue */
+	struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */
 	u_int mtu = ntohl(icmp6->icmp6_mtu);
 	struct rtentry *rt = NULL;
 	struct sockaddr_in6 sin6;
@@ -1160,20 +1218,18 @@ icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
 	 * we reject ICMPv6 too big with abnormally small value.
 	 * XXX what is the good definition of "abnormally small"?
 	 */
-	if (mtu < sizeof(struct ip6_hdr) + sizeof(struct ip6_frag) + 8)
+	if (mtu < sizeof(struct ip6_hdr) + sizeof(struct ip6_frag) + 8) {
 		return;
+	}
 
-	if (!validated)
+	if (!validated) {
 		return;
+	}
 
-	/*
-	 * In case the suggested mtu is less than IPV6_MMTU, we
-	 * only need to remember that it was for above mentioned
-	 * "alwaysfrag" case.
-	 * Try to be as close to the spec as possible.
-	 */
-	if (mtu < IPV6_MMTU)
-		mtu = IPV6_MMTU - 8;
+	/* Limit the MTU to the minimum IPv6 MTU */
+	if (mtu < IPV6_MMTU) {
+		mtu = IPV6_MMTU;
+	}
 
 	bzero(&sin6, sizeof(sin6));
 	sin6.sin6_family = PF_INET6;
@@ -1219,7 +1275,7 @@ icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
  * - joins NI group address at in6_ifattach() time only, does not cope
  *   with hostname changes by sethostname(3)
  */
-#define hostnamelen	strlen(hostname)
+#define hostnamelen     (uint32_t)strlen(hostname)
 static struct mbuf *
 ni6_input(struct mbuf *m, int off)
 {
@@ -1229,12 +1285,12 @@ ni6_input(struct mbuf *m, int off)
 	int subjlen;
 	int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
 	struct ni_reply_fqdn *fqdn;
-	int addrs;		/* for NI_QTYPE_NODEADDR */
+	int addrs;              /* for NI_QTYPE_NODEADDR */
 	struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
 	struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */
 	struct sockaddr_in6 sin6_d; /* XXX: we should retrieve this from m_aux */
 	struct ip6_hdr *ip6;
-	int oldfqdn = 0;	/* if 1, return pascal string (03 draft) */
+	int oldfqdn = 0;        /* if 1, return pascal string (03 draft) */
 	char *subj = NULL;
 
 	ip6 = mtod(m, struct ip6_hdr *);
@@ -1244,7 +1300,7 @@ ni6_input(struct mbuf *m, int off)
 	IP6_EXTHDR_GET(ni6, struct icmp6_nodeinfo *, m, off, sizeof(*ni6));
 	if (ni6 == NULL) {
 		/* m is already reclaimed */
-		return (NULL);
+		return NULL;
 	}
 #endif
 
@@ -1263,8 +1319,9 @@ ni6_input(struct mbuf *m, int off)
 	 */
 	if ((icmp6_nodeinfo & ICMP6_NODEINFO_GLOBALOK) == 0 &&
 	    !IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) &&
-	    !IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src))
+	    !IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
 		goto bad;
+	}
 
 	/*
 	 * Validate IPv6 destination address.
@@ -1275,20 +1332,21 @@ ni6_input(struct mbuf *m, int off)
 	 * [RFC4602, Section 5.]
 	 */
 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
-		if (!IN6_IS_ADDR_MC_LINKLOCAL(&ip6->ip6_dst))
+		if (!IN6_IS_ADDR_MC_LINKLOCAL(&ip6->ip6_dst) &&
+		    !IN6_IS_ADDR_MC_UNICAST_BASED_LINKLOCAL(&ip6->ip6_dst)) {
 			goto bad;
+		}
 		/* else it's a link-local multicast, fine */
-	} else {		/* unicast or anycast */
+	} else {                /* unicast or anycast */
 		uint32_t ia6_flags;
 
-		if (ip6_getdstifaddr_info(m, NULL, &ia6_flags) != 0)
+		if (ip6_getdstifaddr_info(m, NULL, &ia6_flags) != 0) {
 			goto bad; /* XXX impossible */
-
+		}
 		if ((ia6_flags & IN6_IFF_TEMPORARY) &&
 		    !(icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK)) {
-			nd6log((LOG_DEBUG, "ni6_input: ignore node info to "
-				"a temporary address in %s:%d",
-			       __FILE__, __LINE__));
+			nd6log(debug, "ni6_input: ignore node info to a temporary address in %s:%d",
+			    __func__, __LINE__);
 			goto bad;
 		}
 	}
@@ -1300,9 +1358,10 @@ ni6_input(struct mbuf *m, int off)
 	case NI_QTYPE_NOOP:
 	case NI_QTYPE_SUPTYPES:
 		/* 07 draft */
-		if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0)
+		if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0) {
 			break;
-		/* FALLTHROUGH */
+		}
+		OS_FALLTHROUGH;
 	case NI_QTYPE_FQDN:
 	case NI_QTYPE_NODEADDR:
 	case NI_QTYPE_IPV4ADDR:
@@ -1321,12 +1380,14 @@ ni6_input(struct mbuf *m, int off)
 				break;
 			}
 #if ICMP6_NI_SUBJ_IPV6 != 0
-			if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6)
+			if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6) {
 				goto bad;
+			}
 #endif
 
-			if (subjlen != sizeof(struct in6_addr))
+			if (subjlen != sizeof(struct in6_addr)) {
 				goto bad;
+			}
 
 			/*
 			 * Validate Subject address.
@@ -1346,7 +1407,7 @@ ni6_input(struct mbuf *m, int off)
 			m_copydata(m, off + sizeof(struct icmp6_nodeinfo),
 			    subjlen, (caddr_t)&sin6.sin6_addr);
 			sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
-							      &sin6.sin6_addr);
+			    &sin6.sin6_addr);
 			in6_embedscope(&sin6.sin6_addr, &sin6, NULL, NULL,
 			    NULL);
 			bzero(&sin6_d, sizeof(sin6_d));
@@ -1354,12 +1415,13 @@ ni6_input(struct mbuf *m, int off)
 			sin6_d.sin6_len = sizeof(sin6_d); /* ditto */
 			sin6_d.sin6_addr = ip6->ip6_dst;
 			sin6_d.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
-								&ip6->ip6_dst);
+			    &ip6->ip6_dst);
 			in6_embedscope(&sin6_d.sin6_addr, &sin6_d, NULL, NULL,
 			    NULL);
 			subj = (char *)&sin6;
-			if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d))
+			if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d)) {
 				break;
+			}
 
 			/*
 			 * XXX if we are to allow other cases, we should really
@@ -1384,22 +1446,26 @@ ni6_input(struct mbuf *m, int off)
 			 *   wildcard match, if gethostname(3) side has
 			 *   truncated hostname.
 			 */
+			lck_mtx_lock(&hostname_lock);
 			n = ni6_nametodns(hostname, hostnamelen, 0);
-			if (!n || n->m_next || n->m_len == 0)
+			lck_mtx_unlock(&hostname_lock);
+			if (!n || n->m_next || n->m_len == 0) {
 				goto bad;
+			}
 			IP6_EXTHDR_GET(subj, char *, m,
 			    off + sizeof(struct icmp6_nodeinfo), subjlen);
-			if (subj == NULL)
+			if (subj == NULL) {
 				goto bad;
+			}
 			if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *),
-					n->m_len)) {
+			    n->m_len)) {
 				goto bad;
 			}
 			m_freem(n);
 			n = NULL;
 			break;
 
-		case ICMP6_NI_SUBJ_IPV4:	/* XXX: to be implemented? */
+		case ICMP6_NI_SUBJ_IPV4:        /* XXX: to be implemented? */
 		default:
 			goto bad;
 		}
@@ -1409,20 +1475,22 @@ ni6_input(struct mbuf *m, int off)
 	/* refuse based on configuration.  XXX ICMP6_NI_REFUSED? */
 	switch (qtype) {
 	case NI_QTYPE_FQDN:
-		if ((icmp6_nodeinfo & ICMP6_NODEINFO_FQDNOK) == 0)
+		if ((icmp6_nodeinfo & ICMP6_NODEINFO_FQDNOK) == 0) {
 			goto bad;
+		}
 		break;
 	case NI_QTYPE_NODEADDR:
 	case NI_QTYPE_IPV4ADDR:
-		if ((icmp6_nodeinfo & ICMP6_NODEINFO_NODEADDROK) == 0)
+		if ((icmp6_nodeinfo & ICMP6_NODEINFO_NODEADDROK) == 0) {
 			goto bad;
+		}
 		break;
 	}
 
 	/* guess reply length */
 	switch (qtype) {
 	case NI_QTYPE_NOOP:
-		break;		/* no reply data */
+		break;          /* no reply data */
 	case NI_QTYPE_SUPTYPES:
 		replylen += sizeof(u_int32_t);
 		break;
@@ -1433,8 +1501,9 @@ ni6_input(struct mbuf *m, int off)
 	case NI_QTYPE_NODEADDR:
 		addrs = ni6_addrs(ni6, &ifp, subj);
 		if ((replylen += addrs * (sizeof(struct in6_addr) +
-		    sizeof(u_int32_t))) > MCLBYTES)
+		    sizeof(u_int32_t))) > MCLBYTES) {
 			replylen = MCLBYTES; /* XXX: will truncate pkt later */
+		}
 		break;
 	case NI_QTYPE_IPV4ADDR:
 		/* unsupported - should respond with unknown Qtype? */
@@ -1457,12 +1526,13 @@ ni6_input(struct mbuf *m, int off)
 	}
 
 	/* allocate an mbuf to reply. */
-	MGETHDR(n, M_DONTWAIT, m->m_type);	/* MAC-OK */
+	MGETHDR(n, M_DONTWAIT, m->m_type);      /* MAC-OK */
 	if (n == NULL) {
 		m_freem(m);
-		if (ifp != NULL)
+		if (ifp != NULL) {
 			ifnet_release(ifp);
-		return (NULL);
+		}
+		return NULL;
 	}
 	M_COPY_PKTHDR(n, m); /* just for recvif */
 	if (replylen > MHLEN) {
@@ -1495,7 +1565,7 @@ ni6_input(struct mbuf *m, int off)
 	{
 		u_int32_t v;
 		nni6->ni_code = ICMP6_NI_SUCCESS;
-		nni6->ni_flags = htons(0x0000);	/* raw bitmap */
+		nni6->ni_flags = htons(0x0000); /* raw bitmap */
 		/* supports NOOP, SUPTYPES, FQDN, and NODEADDR */
 		v = (u_int32_t)htonl(0x0000000f);
 		bcopy(&v, nni6 + 1, sizeof(u_int32_t));
@@ -1504,19 +1574,23 @@ ni6_input(struct mbuf *m, int off)
 	case NI_QTYPE_FQDN:
 		nni6->ni_code = ICMP6_NI_SUCCESS;
 		fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +
-						sizeof(struct ip6_hdr) +
-						sizeof(struct icmp6_nodeinfo));
+		    sizeof(struct ip6_hdr) +
+		    sizeof(struct icmp6_nodeinfo));
 		nni6->ni_flags = 0; /* XXX: meaningless TTL */
-		fqdn->ni_fqdn_ttl = 0;	/* ditto. */
+		fqdn->ni_fqdn_ttl = 0;  /* ditto. */
 		/*
 		 * XXX do we really have FQDN in variable "hostname"?
 		 */
+		lck_mtx_lock(&hostname_lock);
 		n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn);
-		if (n->m_next == NULL)
+		lck_mtx_unlock(&hostname_lock);
+		if (n->m_next == NULL) {
 			goto bad;
+		}
 		/* XXX we assume that n->m_next is not a chain */
-		if (n->m_next->m_next != NULL)
+		if (n->m_next->m_next != NULL) {
 			goto bad;
+		}
 		n->m_pkthdr.len += n->m_next->m_len;
 		break;
 	case NI_QTYPE_NODEADDR:
@@ -1526,30 +1600,33 @@ ni6_input(struct mbuf *m, int off)
 		nni6->ni_code = ICMP6_NI_SUCCESS;
 		n->m_pkthdr.len = n->m_len =
 		    sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
-		lenlim = M_TRAILINGSPACE(n);
+		lenlim = (int)M_TRAILINGSPACE(n);
 		copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
 		/* XXX: reset mbuf length */
 		n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
-			sizeof(struct icmp6_nodeinfo) + copied;
+		    sizeof(struct icmp6_nodeinfo) + copied;
 		break;
 	}
 	default:
-		break;		/* XXX impossible! */
+		break;          /* XXX impossible! */
 	}
 
 	nni6->ni_type = ICMP6_NI_REPLY;
 	m_freem(m);
-	if (ifp != NULL)
+	if (ifp != NULL) {
 		ifnet_release(ifp);
-	return (n);
+	}
+	return n;
 
 bad:
 	m_freem(m);
-	if (n)
+	if (n) {
 		m_freem(n);
-	if (ifp != NULL)
+	}
+	if (ifp != NULL) {
 		ifnet_release(ifp);
-	return (NULL);
+	}
+	return NULL;
 }
 #undef hostnamelen
 
@@ -1562,33 +1639,37 @@ bad:
 static struct mbuf *
 ni6_nametodns(
 	const char *name,
-	int namelen,
-	int old)	/* return pascal string if non-zero */
+	uint32_t namelen,
+	int old)        /* return pascal string if non-zero */
 {
 	struct mbuf *m;
 	char *cp, *ep;
 	const char *p, *q;
-	int i, len, nterm;
+	int i, nterm;
+	uint32_t len;
 
-	if (old)
+	if (old) {
 		len = namelen + 1;
-	else
+	} else {
 		len = MCLBYTES;
+	}
 
 	/* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */
 	MGET(m, M_DONTWAIT, MT_DATA);
 	if (m && len > MLEN) {
 		MCLGET(m, M_DONTWAIT);
-		if ((m->m_flags & M_EXT) == 0)
+		if ((m->m_flags & M_EXT) == 0) {
 			goto fail;
+		}
 	}
-	if (!m)
+	if (!m) {
 		goto fail;
+	}
 	m->m_next = NULL;
 
 	if (old) {
 		m->m_len = len;
-		*mtod(m, char *) = namelen;
+		*mtod(m, char *) = (char)namelen;
 		bcopy(name, mtod(m, char *) + 1, namelen);
 		return m;
 	} else {
@@ -1597,8 +1678,9 @@ ni6_nametodns(
 		ep = mtod(m, char *) + M_TRAILINGSPACE(m);
 
 		/* if not certain about my name, return empty buffer */
-		if (namelen == 0)
+		if (namelen == 0) {
 			return m;
+		}
 
 		/*
 		 * guess if it looks like shortened hostname, or FQDN.
@@ -1606,51 +1688,60 @@ ni6_nametodns(
 		 */
 		i = 0;
 		for (p = name; p < name + namelen; p++) {
-			if (*p && *p == '.')
+			if (*p && *p == '.') {
 				i++;
+			}
 		}
-		if (i < 2)
+		if (i < 2) {
 			nterm = 2;
-		else
+		} else {
 			nterm = 1;
+		}
 
 		p = name;
 		while (cp < ep && p < name + namelen) {
 			i = 0;
-			for (q = p; q < name + namelen && *q && *q != '.'; q++)
+			for (q = p; q < name + namelen && *q && *q != '.'; q++) {
 				i++;
+			}
 			/* result does not fit into mbuf */
-			if (cp + i + 1 >= ep)
+			if (cp + i + 1 >= ep) {
 				goto fail;
+			}
 			/*
 			 * DNS label length restriction, RFC1035 page 8.
 			 * "i == 0" case is included here to avoid returning
 			 * 0-length label on "foo..bar".
 			 */
-			if (i <= 0 || i >= 64)
+			if (i <= 0 || i >= 64) {
 				goto fail;
-			*cp++ = i;
+			}
+			*cp++ = (char)i;
 			bcopy(p, cp, i);
 			cp += i;
 			p = q;
-			if (p < name + namelen && *p == '.')
+			if (p < name + namelen && *p == '.') {
 				p++;
+			}
 		}
 		/* termination */
-		if (cp + nterm >= ep)
+		if (cp + nterm >= ep) {
 			goto fail;
-		while (nterm-- > 0)
+		}
+		while (nterm-- > 0) {
 			*cp++ = '\0';
-		m->m_len = cp - mtod(m, char *);
+		}
+		m->m_len = (int32_t)(cp - mtod(m, char *));
 		return m;
 	}
 
 	panic("should not reach here");
 	/* NOTREACHED */
 
- fail:
-	if (m)
+fail:
+	if (m) {
 		m_freem(m);
+	}
 	return NULL;
 }
 
@@ -1666,54 +1757,67 @@ ni6_dnsmatch(const char *a, int alen, const char *b, int blen)
 	int l;
 
 	/* simplest case - need validation? */
-	if (alen == blen && bcmp(a, b, alen) == 0)
+	if (alen == blen && bcmp(a, b, alen) == 0) {
 		return 1;
+	}
 
 	a0 = a;
 	b0 = b;
 
 	/* termination is mandatory */
-	if (alen < 2 || blen < 2)
+	if (alen < 2 || blen < 2) {
 		return 0;
-	if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0')
+	}
+	if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0') {
 		return 0;
+	}
 	alen--;
 	blen--;
 
 	while (a - a0 < alen && b - b0 < blen) {
-		if (a - a0 + 1 > alen || b - b0 + 1 > blen)
+		if (a - a0 + 1 > alen || b - b0 + 1 > blen) {
 			return 0;
+		}
 
-		if ((signed char)a[0] < 0 || (signed char)b[0] < 0)
+		if ((signed char)a[0] < 0 || (signed char)b[0] < 0) {
 			return 0;
+		}
 		/* we don't support compression yet */
-		if (a[0] >= 64 || b[0] >= 64)
+		if (a[0] >= 64 || b[0] >= 64) {
 			return 0;
+		}
 
 		/* truncated case */
-		if (a[0] == 0 && a - a0 == alen - 1)
+		if (a[0] == 0 && a - a0 == alen - 1) {
 			return 1;
-		if (b[0] == 0 && b - b0 == blen - 1)
+		}
+		if (b[0] == 0 && b - b0 == blen - 1) {
 			return 1;
-		if (a[0] == 0 || b[0] == 0)
+		}
+		if (a[0] == 0 || b[0] == 0) {
 			return 0;
+		}
 
-		if (a[0] != b[0])
+		if (a[0] != b[0]) {
 			return 0;
+		}
 		l = a[0];
-		if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen)
+		if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen) {
 			return 0;
-		if (bcmp(a + 1, b + 1, l) != 0)
+		}
+		if (bcmp(a + 1, b + 1, l) != 0) {
 			return 0;
+		}
 
 		a += 1 + l;
 		b += 1 + l;
 	}
 
-	if (a - a0 == alen && b - b0 == blen)
+	if (a - a0 == alen && b - b0 == blen) {
 		return 1;
-	else
+	} else {
 		return 0;
+	}
 }
 
 /*
@@ -1729,14 +1833,16 @@ ni6_addrs(struct icmp6_nodeinfo *ni6, struct ifnet **ifpp, char *subj)
 	int addrs = 0, addrsofif, iffound = 0;
 	int niflags = ni6->ni_flags;
 
-	if (ifpp != NULL)
+	if (ifpp != NULL) {
 		*ifpp = NULL;
+	}
 
 	if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) {
 		switch (ni6->ni_code) {
 		case ICMP6_NI_SUBJ_IPV6:
-			if (subj == NULL) /* must be impossible... */
-				return(0);
+			if (subj == NULL) { /* must be impossible... */
+				return 0;
+			}
 			subj_ip6 = (struct sockaddr_in6 *)(void *)subj;
 			break;
 		default:
@@ -1744,7 +1850,7 @@ ni6_addrs(struct icmp6_nodeinfo *ni6, struct ifnet **ifpp, char *subj)
 			 * XXX: we only support IPv6 subject address for
 			 * this Qtype.
 			 */
-			return (0);
+			return 0;
 		}
 	}
 
@@ -1763,8 +1869,9 @@ ni6_addrs(struct icmp6_nodeinfo *ni6, struct ifnet **ifpp, char *subj)
 
 			if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 &&
 			    IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr,
-					       &ifa6->ia_addr.sin6_addr))
+			    &ifa6->ia_addr.sin6_addr)) {
 				iffound = 1;
+			}
 
 			/*
 			 * IPv4-mapped addresses can only be returned by a
@@ -1825,19 +1932,19 @@ ni6_addrs(struct icmp6_nodeinfo *ni6, struct ifnet **ifpp, char *subj)
 				ifnet_reference(ifp);
 			}
 			ifnet_head_done();
-			return(addrsofif);
+			return addrsofif;
 		}
 
 		addrs += addrsofif;
 	}
 	ifnet_head_done();
 
-	return (addrs);
+	return addrs;
 }
 
 static int
 ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
-		struct ifnet *ifp0, int resid)
+    struct ifnet *ifp0, int resid)
 {
 	struct ifnet *ifp = ifp0;
 	struct in6_ifaddr *ifa6;
@@ -1849,19 +1956,20 @@ ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
 	u_int32_t ltime;
 	uint64_t now = net_uptime();
 
-	if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL))
-		return (0);	/* needless to copy */
-
-  again:
+	if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL)) {
+		return 0;     /* needless to copy */
+	}
+again:
 
 	ifnet_head_lock_shared();
-	if (ifp == NULL)
+	if (ifp == NULL) {
 		ifp = TAILQ_FIRST(&ifnet_head);
+	}
 
 	for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
 		ifnet_lock_shared(ifp);
 		for (ifa = ifp->if_addrlist.tqh_first; ifa;
-		     ifa = ifa->ifa_list.tqe_next) {
+		    ifa = ifa->ifa_list.tqe_next) {
 			struct in6_addrlifetime_i *lt;
 
 			IFA_LOCK(ifa);
@@ -1879,8 +1987,9 @@ ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
 				 */
 
 				/* record the interface for later search */
-				if (ifp_dep == NULL)
+				if (ifp_dep == NULL) {
 					ifp_dep = ifp;
+				}
 
 				IFA_UNLOCK(ifa);
 				continue;
@@ -1938,10 +2047,10 @@ ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
 				 * Set the truncate flag and return.
 				 */
 				nni6->ni_flags |=
-					NI_NODEADDR_FLAG_TRUNCATE;
+				    NI_NODEADDR_FLAG_TRUNCATE;
 				ifnet_lock_done(ifp);
 				ifnet_head_done();
-				return(copied);
+				return copied;
 			}
 
 			/*
@@ -1963,10 +2072,11 @@ ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
 			if (lt->ia6ti_expire == 0) {
 				ltime = ND6_INFINITE_LIFETIME;
 			} else {
-				if (lt->ia6ti_expire > now)
-					ltime = htonl(lt->ia6ti_expire - now);
-				else
+				if (lt->ia6ti_expire > now) {
+					ltime = htonl((uint32_t)(lt->ia6ti_expire - now));
+				} else {
 					ltime = 0;
+				}
 			}
 
 			bcopy(&ltime, cp, sizeof(u_int32_t));
@@ -1974,20 +2084,22 @@ ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
 
 			/* copy the address itself */
 			bcopy(&ifa6->ia_addr.sin6_addr, cp,
-			      sizeof(struct in6_addr));
+			    sizeof(struct in6_addr));
 			/* XXX: KAME link-local hack; remove ifindex */
-			if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr))
+			if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr)) {
 				((struct in6_addr *)(void *)cp)->s6_addr16[1] = 0;
+			}
 			cp += sizeof(struct in6_addr);
 
 			resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t));
 			copied += (sizeof(struct in6_addr) +
-				   sizeof(u_int32_t));
+			    sizeof(u_int32_t));
 			IFA_UNLOCK(ifa);
 		}
 		ifnet_lock_done(ifp);
-		if (ifp0)	/* we need search only on the specified IF */
+		if (ifp0) {     /* we need search only on the specified IF */
 			break;
+		}
 	}
 	ifnet_head_done();
 
@@ -1998,7 +2110,7 @@ ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
 		goto again;
 	}
 
-	return(copied);
+	return copied;
 }
 
 /*
@@ -2036,36 +2148,48 @@ icmp6_rip6_input(struct mbuf **mp, int off)
 	rip6src.sin6_family = AF_INET6;
 	rip6src.sin6_len = sizeof(struct sockaddr_in6);
 	rip6src.sin6_addr = ip6->ip6_src;
-	if (sa6_recoverscope(&rip6src, TRUE)) 
-		return (IPPROTO_DONE);
+	if (sa6_recoverscope(&rip6src, TRUE)) {
+		return IPPROTO_DONE;
+	}
 
 	lck_rw_lock_shared(ripcbinfo.ipi_lock);
 	LIST_FOREACH(in6p, &ripcb, inp_list)
 	{
-		if ((in6p->inp_vflag & INP_IPV6) == 0)
+		if ((in6p->inp_vflag & INP_IPV6) == 0) {
 			continue;
-		if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6)
+		}
+		if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6) {
 			continue;
+		}
 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
-		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
+		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst)) {
 			continue;
+		}
 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
-		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
+		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src)) {
 			continue;
+		}
 		if (in6p->in6p_icmp6filt
 		    && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
-				 in6p->in6p_icmp6filt))
+		    in6p->in6p_icmp6filt)) {
 			continue;
+		}
 
-		if (inp_restricted_recv(in6p, ifp))
+		if (inp_restricted_recv(in6p, ifp)) {
 			continue;
+		}
 
 		if (last) {
-			struct	mbuf *n;
+			struct  mbuf *n;
 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
 				if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
+#if CONTENT_FILTER
+				    /* Content Filter needs to see local address */
+				    (last->in6p_socket->so_cfil_db != NULL) ||
+#endif
 				    (last->in6p_socket->so_options & SO_TIMESTAMP) != 0 ||
-				    (last->in6p_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0) {
+				    (last->in6p_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
+				    (last->in6p_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
 					ret = ip6_savecontrol(last, n, &opts);
 					if (ret != 0) {
 						m_freem(n);
@@ -2078,8 +2202,8 @@ icmp6_rip6_input(struct mbuf **mp, int off)
 				m_adj(n, off);
 				so_recv_data_stat(last->in6p_socket, m, 0);
 				if (sbappendaddr(&last->in6p_socket->so_rcv,
-						 (struct sockaddr *)&rip6src,
-						 n, opts, NULL) != 0) {
+				    (struct sockaddr *)&rip6src,
+				    n, opts, NULL) != 0) {
 					sorwakeup(last->in6p_socket);
 				}
 				opts = NULL;
@@ -2089,8 +2213,13 @@ icmp6_rip6_input(struct mbuf **mp, int off)
 	}
 	if (last) {
 		if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
+#if CONTENT_FILTER
+		    /* Content Filter needs to see local address */
+		    (last->in6p_socket->so_cfil_db != NULL) ||
+#endif
 		    (last->in6p_socket->so_options & SO_TIMESTAMP) != 0 ||
-		    (last->in6p_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0) {
+		    (last->in6p_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
+		    (last->in6p_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
 			ret = ip6_savecontrol(last, m, &opts);
 			if (ret != 0) {
 				goto error;
@@ -2100,7 +2229,7 @@ icmp6_rip6_input(struct mbuf **mp, int off)
 		m_adj(m, off);
 		so_recv_data_stat(last->in6p_socket, m, 0);
 		if (sbappendaddr(&last->in6p_socket->so_rcv,
-				 (struct sockaddr *)&rip6src, m, opts, NULL) != 0) {
+		    (struct sockaddr *)&rip6src, m, opts, NULL) != 0) {
 			sorwakeup(last->in6p_socket);
 		}
 	} else {
@@ -2135,9 +2264,14 @@ icmp6_reflect(struct mbuf *m, size_t off)
 	struct sockaddr_in6 sa6_src, sa6_dst;
 	struct nd_ifinfo *ndi = NULL;
 	u_int32_t oflow;
-	struct ip6_out_args ip6oa = { IFSCOPE_NONE, { 0 },
-	    IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR, 0,
-	    SO_TC_UNSPEC, _NET_SERVICE_TYPE_UNSPEC };
+	struct ip6_out_args ip6oa;
+
+	bzero(&ip6oa, sizeof(ip6oa));
+	ip6oa.ip6oa_boundif = IFSCOPE_NONE;
+	ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR |
+	    IP6OAF_INTCOPROC_ALLOWED | IP6OAF_AWDL_UNRESTRICTED;
+	ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
+	ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 
 	if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
 		ip6oa.ip6oa_boundif = m->m_pkthdr.rcvif->if_index;
@@ -2146,10 +2280,10 @@ icmp6_reflect(struct mbuf *m, size_t off)
 
 	/* too short to reflect */
 	if (off < sizeof(struct ip6_hdr)) {
-		nd6log((LOG_DEBUG,
-		    "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n",
+		nd6log(debug,
+		    "sanity fail: off=%x, sizeof(ip6)=%x in %s:%d\n",
 		    (u_int32_t)off, (u_int32_t)sizeof(struct ip6_hdr),
-		    __FILE__, __LINE__));
+		    __func__, __LINE__);
 		goto bad;
 	}
 
@@ -2163,19 +2297,21 @@ icmp6_reflect(struct mbuf *m, size_t off)
 
 		l = off - sizeof(struct ip6_hdr);
 		m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6);
-		m_adj(m, l);
+		m_adj(m, (int)l);
 		l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
 		if (m->m_len < l) {
-			if ((m_ip6hdr = m_pulldown(m, 0, l, NULL)) == NULL)
+			if ((m_ip6hdr = m_pulldown(m, 0, (int)l, NULL)) == NULL) {
 				return;
+			}
 		}
 		bcopy((caddr_t)&nip6, mtod(m, caddr_t), sizeof(nip6));
-	} else /* off == sizeof(struct ip6_hdr) */ {
+	} else { /* off == sizeof(struct ip6_hdr) */
 		size_t l;
 		l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
 		if (m->m_len < l) {
-			if ((m_ip6hdr = m_pulldown(m, 0, l, NULL)) == NULL)
+			if ((m_ip6hdr = m_pulldown(m, 0, (int)l, NULL)) == NULL) {
 				return;
+			}
 		}
 	}
 	plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
@@ -2221,10 +2357,10 @@ icmp6_reflect(struct mbuf *m, size_t off)
 	 * to search in the ifaddr list.
 	 */
 	lck_rw_lock_shared(&in6_ifaddr_rwlock);
-	for (ia = in6_ifaddrs; ia; ia = ia->ia_next) {
+	TAILQ_FOREACH(ia, IN6ADDR_HASH(&t), ia6_hash) {
 		IFA_LOCK(&ia->ia_ifa);
 		if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) &&
-		    (ia->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) == 0) {
+		    (ia->ia6_flags & (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY | IN6_IFF_CLAT46)) == 0) {
 			IFA_UNLOCK(&ia->ia_ifa);
 			src = &t;
 			break;
@@ -2269,10 +2405,10 @@ icmp6_reflect(struct mbuf *m, size_t off)
 		    &src_storage, ip6oa.ip6oa_boundif, &e);
 		ROUTE_RELEASE(&ro);
 		if (src == NULL) {
-			nd6log((LOG_DEBUG,
+			nd6log(debug,
 			    "icmp6_reflect: source can't be determined: "
 			    "dst=%s, error=%d\n",
-			    ip6_sprintf(&sa6_src.sin6_addr), e));
+			    ip6_sprintf(&sa6_src.sin6_addr), e);
 			goto bad;
 		}
 	}
@@ -2299,7 +2435,7 @@ icmp6_reflect(struct mbuf *m, size_t off)
 		ip6->ip6_hlim = ndi->chlim;
 		lck_mtx_unlock(&ndi->lock);
 	} else {
-		ip6->ip6_hlim = ip6_defhlim;
+		ip6->ip6_hlim = (uint8_t)ip6_defhlim;
 	}
 	/* Use the same traffic class as in the request to match IPv4 */
 	icmp6->icmp6_cksum = 0;
@@ -2309,7 +2445,7 @@ icmp6_reflect(struct mbuf *m, size_t off)
 	/*
 	 * XXX option handling
 	 */
-	m->m_flags &= ~(M_BCAST|M_MCAST);
+	m->m_flags &= ~(M_BCAST | M_MCAST);
 
 	if (outif != NULL) {
 		ifnet_release(outif);
@@ -2327,63 +2463,75 @@ icmp6_reflect(struct mbuf *m, size_t off)
 
 bad:
 	m_freem(m);
-	if (outif != NULL)
+	if (outif != NULL) {
 		ifnet_release(outif);
+	}
 	return;
 }
 
 static const char *
 icmp6_redirect_diag(struct in6_addr *src6,
-		    struct in6_addr *dst6,
-		    struct in6_addr *tgt6)
+    struct in6_addr *dst6,
+    struct in6_addr *tgt6)
 {
 	static char buf[1024];
 	snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
-		ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
+	    ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
 	return buf;
 }
 
 void
-icmp6_redirect_input(struct mbuf *m, int off)
+icmp6_redirect_input(struct mbuf *m, int off, int icmp6len)
 {
-	struct ifnet *ifp = m->m_pkthdr.rcvif;
-	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
-	struct nd_redirect *nd_rd;
-	int icmp6len = ntohs(ip6->ip6_plen);
+	struct ifnet *ifp = NULL;
+	struct ip6_hdr *ip6 = NULL;
+	struct nd_redirect *nd_rd = NULL;
 	char *lladdr = NULL;
 	int lladdrlen = 0;
 	u_char *redirhdr = NULL;
 	int redirhdrlen = 0;
 	struct rtentry *rt = NULL;
-	int is_router;
-	int is_onlink;
-	struct in6_addr src6 = ip6->ip6_src;
-	struct in6_addr redtgt6;
-	struct in6_addr reddst6;
-	union nd_opts ndopts;
-
-	if (!m || !ifp)
+	int is_router = 0;
+	int is_onlink = 0;
+	struct in6_addr src6 = {};
+	struct in6_addr redtgt6 = {};
+	struct in6_addr reddst6 = {};
+	union nd_opts ndopts = {};
+
+	if (m == NULL) {
 		return;
+	}
+
+	ifp = m->m_pkthdr.rcvif;
+	if (ifp == NULL) {
+		goto freeit;
+	}
 
 	/*
 	 * If we are an advertising router on this interface,
 	 * don't update route by icmp6 redirect.
 	 */
-	if (ifp->if_eflags & IFEF_IPV6_ROUTER)
+	if (ifp->if_ipv6_router_mode == IPV6_ROUTER_MODE_EXCLUSIVE) {
 		goto freeit;
-	if (!icmp6_rediraccept)
+	}
+	if (!icmp6_rediraccept) {
 		goto freeit;
+	}
 
+	ip6 = mtod(m, struct ip6_hdr *);
+	src6 = ip6->ip6_src;
 #ifndef PULLDOWN_TEST
-	IP6_EXTHDR_CHECK(m, off, icmp6len, return);
-	nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
+	IP6_EXTHDR_CHECK(m, off, icmp6len, return );
+	nd_rd = (struct nd_redirect *)(mtod(m, caddr_t) + off);
 #else
 	IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);
 	if (nd_rd == NULL) {
 		icmp6stat.icp6s_tooshort++;
-		return;
+		goto freeit;
 	}
 #endif
+	ip6 = mtod(m, struct ip6_hdr *);
+
 	redtgt6 = nd_rd->nd_rd_target;
 	reddst6 = nd_rd->nd_rd_dst;
 
@@ -2394,83 +2542,85 @@ icmp6_redirect_input(struct mbuf *m, int off)
 
 	/* validation */
 	if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
-		nd6log((LOG_ERR,
-			"ICMP6 redirect sent from %s rejected; "
-			"must be from linklocal\n", ip6_sprintf(&src6)));
+		nd6log(error,
+		    "ICMP6 redirect sent from %s rejected; "
+		    "must be from linklocal\n", ip6_sprintf(&src6));
 		goto bad;
 	}
-	if (ip6->ip6_hlim != 255) {
-		nd6log((LOG_ERR,
-			"ICMP6 redirect sent from %s rejected; "
-			"hlim=%d (must be 255)\n",
-			ip6_sprintf(&src6), ip6->ip6_hlim));
+	if (ip6->ip6_hlim != IPV6_MAXHLIM) {
+		nd6log(error,
+		    "ICMP6 redirect sent from %s rejected; "
+		    "hlim=%d (must be 255)\n",
+		    ip6_sprintf(&src6), ip6->ip6_hlim);
 		goto bad;
 	}
-    {
-	/* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
-	struct sockaddr_in6 sin6;
-	struct in6_addr *gw6;
+	{
+		/* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
+		struct sockaddr_in6 sin6;
+		struct in6_addr *gw6;
 
-	bzero(&sin6, sizeof(sin6));
-	sin6.sin6_family = AF_INET6;
-	sin6.sin6_len = sizeof(struct sockaddr_in6);
-	bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
-	rt = rtalloc1_scoped((struct sockaddr *)&sin6, 0, 0, ifp->if_index);
-	if (rt) {
-		RT_LOCK(rt);
-		if (rt->rt_gateway == NULL ||
-		    rt->rt_gateway->sa_family != AF_INET6) {
-			nd6log((LOG_ERR,
-			    "ICMP6 redirect rejected; no route "
-			    "with inet6 gateway found for redirect dst: %s\n",
-			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-			RT_UNLOCK(rt);
-			rtfree(rt);
-			goto bad;
-		}
+		bzero(&sin6, sizeof(sin6));
+		sin6.sin6_family = AF_INET6;
+		sin6.sin6_len = sizeof(struct sockaddr_in6);
+		bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
+		rt = rtalloc1_scoped((struct sockaddr *)&sin6, 0, 0, ifp->if_index);
+		if (rt) {
+			RT_LOCK(rt);
+			if (rt->rt_gateway == NULL ||
+			    rt->rt_gateway->sa_family != AF_INET6) {
+				nd6log(error,
+				    "ICMP6 redirect rejected; no route "
+				    "with inet6 gateway found for redirect dst: %s\n",
+				    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+				RT_UNLOCK(rt);
+				rtfree(rt);
+				goto bad;
+			}
 
-		gw6 = &(((struct sockaddr_in6 *)(void *)
-		    rt->rt_gateway)->sin6_addr);
-		if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
-			nd6log((LOG_ERR,
-				"ICMP6 redirect rejected; "
-				"not equal to gw-for-src=%s (must be same): "
-				"%s\n",
-				ip6_sprintf(gw6),
-				icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-			RT_UNLOCK(rt);
-			rtfree(rt);
+			gw6 = &(((struct sockaddr_in6 *)(void *)
+			    rt->rt_gateway)->sin6_addr);
+			if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
+				nd6log(error,
+				    "ICMP6 redirect rejected; "
+				    "not equal to gw-for-src=%s (must be same): "
+				    "%s\n",
+				    ip6_sprintf(gw6),
+				    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+				RT_UNLOCK(rt);
+				rtfree(rt);
+				goto bad;
+			}
+		} else {
+			nd6log(error,
+			    "ICMP6 redirect rejected; "
+			    "no route found for redirect dst: %s\n",
+			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
 			goto bad;
 		}
-	} else {
-		nd6log((LOG_ERR,
-			"ICMP6 redirect rejected; "
-			"no route found for redirect dst: %s\n",
-			icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-		goto bad;
+		RT_UNLOCK(rt);
+		rtfree(rt);
+		rt = NULL;
 	}
-	RT_UNLOCK(rt);
-	rtfree(rt);
-	rt = NULL;
-    }
 	if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
-		nd6log((LOG_ERR,
-			"ICMP6 redirect rejected; "
-			"redirect dst must be unicast: %s\n",
-			icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+		nd6log(error,
+		    "ICMP6 redirect rejected; "
+		    "redirect dst must be unicast: %s\n",
+		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 
 	is_router = is_onlink = 0;
-	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
-		is_router = 1;	/* router case */
-	if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
-		is_onlink = 1;	/* on-link destination case */
+	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) {
+		is_router = 1;  /* router case */
+	}
+	if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0) {
+		is_onlink = 1;  /* on-link destination case */
+	}
 	if (!is_router && !is_onlink) {
-		nd6log((LOG_ERR,
-			"ICMP6 redirect rejected; "
-			"neither router case nor onlink case: %s\n",
-			icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+		nd6log(error,
+		    "ICMP6 redirect rejected; "
+		    "neither router case nor onlink case: %s\n",
+		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 	/* validation passed */
@@ -2478,9 +2628,9 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	icmp6len -= sizeof(*nd_rd);
 	nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
 	if (nd6_options(&ndopts) < 0) {
-		nd6log((LOG_INFO, "icmp6_redirect_input: "
-			"invalid ND option, rejected: %s\n",
-			icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+		nd6log(info, "icmp6_redirect_input: "
+		    "invalid ND option, rejected: %s\n",
+		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
 		/* nd6_options have incremented stats */
 		goto freeit;
 	}
@@ -2496,19 +2646,19 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	}
 
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
-		nd6log((LOG_INFO,
-			"icmp6_redirect_input: lladdrlen mismatch for %s "
-			"(if %d, icmp6 packet %d): %s\n",
-			ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
-			icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+		nd6log(info,
+		    "icmp6_redirect_input: lladdrlen mismatch for %s "
+		    "(if %d, icmp6 packet %d): %s\n",
+		    ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
+		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 
 	/* RFC 2461 8.3 */
 	nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
-			 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
+	    is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
 
-	if (!is_onlink) {	/* better router case.  perform rtredirect. */
+	if (!is_onlink) {       /* better router case.  perform rtredirect. */
 		/* perform rtredirect */
 		struct sockaddr_in6 sdst;
 		struct sockaddr_in6 sgw;
@@ -2519,7 +2669,7 @@ icmp6_redirect_input(struct mbuf *m, int off)
 		bzero(&ssrc, sizeof(ssrc));
 		sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
 		sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
-			sizeof(struct sockaddr_in6);
+		    sizeof(struct sockaddr_in6);
 		bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr));
 		bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
 		bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr));
@@ -2528,25 +2678,25 @@ icmp6_redirect_input(struct mbuf *m, int off)
 		    (struct sockaddr *)&ssrc, NULL);
 	}
 	/* finally update cached route in each socket via pfctlinput */
-    {
-	struct sockaddr_in6 sdst;
+	{
+		struct sockaddr_in6 sdst;
 
-	bzero(&sdst, sizeof(sdst));
-	sdst.sin6_family = AF_INET6;
-	sdst.sin6_len = sizeof(struct sockaddr_in6);
-	bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
+		bzero(&sdst, sizeof(sdst));
+		sdst.sin6_family = AF_INET6;
+		sdst.sin6_len = sizeof(struct sockaddr_in6);
+		bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
 
-	pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
+		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
 #if IPSEC
-	key_sa_routechange((struct sockaddr *)&sdst);
+		key_sa_routechange((struct sockaddr *)&sdst);
 #endif
-    }
+	}
 
- freeit:
+freeit:
 	m_freem(m);
 	return;
 
- bad:
+bad:
 	icmp6stat.icp6s_badredirect++;
 	m_freem(m);
 }
@@ -2554,36 +2704,43 @@ icmp6_redirect_input(struct mbuf *m, int off)
 void
 icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 {
-	struct ifnet *ifp;	/* my outgoing interface */
+	struct ifnet *ifp;      /* my outgoing interface */
 	struct in6_addr ifp_ll6;
 	struct in6_addr *router_ll6;
-	struct ip6_hdr *sip6;	/* m0 as struct ip6_hdr */
-	struct mbuf *m = NULL;	/* newly allocated one */
-	struct ip6_hdr *ip6;	/* m as struct ip6_hdr */
+	struct ip6_hdr *sip6;   /* m0 as struct ip6_hdr */
+	struct mbuf *m = NULL;  /* newly allocated one */
+	struct ip6_hdr *ip6;    /* m as struct ip6_hdr */
 	struct nd_redirect *nd_rd;
 	size_t maxlen;
 	u_char *p;
 	struct ifnet *outif = NULL;
 	struct sockaddr_in6 src_sa;
-	struct ip6_out_args ip6oa = { IFSCOPE_NONE, { 0 },
-	    IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR, 0,
-	    SO_TC_UNSPEC, _NET_SERVICE_TYPE_UNSPEC };
+	struct ip6_out_args ip6oa;
+
+	bzero(&ip6oa, sizeof(ip6oa));
+	ip6oa.ip6oa_boundif = IFSCOPE_NONE;
+	ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR;
+	ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
+	ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 
 	icmp6_errcount(&icmp6stat.icp6s_outerrhist, ND_REDIRECT, 0);
 
-	if (rt != NULL)
+	if (rt != NULL) {
 		RT_LOCK(rt);
+	}
 
 	/* sanity check */
-	if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp))
+	if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp)) {
 		goto fail;
+	}
 
 	/*
 	 * If we are not a router to begin with, or not an advertising
 	 * router on this interface, don't send icmp6 redirect.
 	 */
-	if (!ip6_forwarding || !(ifp->if_eflags & IFEF_IPV6_ROUTER))
+	if (!ip6_forwarding || ifp->if_ipv6_router_mode != IPV6_ROUTER_MODE_EXCLUSIVE) {
 		goto fail;
+	}
 
 	/*
 	 * Address check:
@@ -2605,12 +2762,13 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 		goto fail;
 	}
 	RT_LOCK(rt);
-	if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
-		goto fail;	/* what should we do here? */
-
+	if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst)) {
+		goto fail;      /* what should we do here? */
+	}
 	/* rate limit */
-	if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
+	if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0)) {
 		goto fail;
+	}
 
 	/*
 	 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
@@ -2620,15 +2778,17 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 #if IPV6_MMTU >= MCLBYTES
 # error assumption failed about IPV6_MMTU and MCLBYTES
 #endif
-	MGETHDR(m, M_DONTWAIT, MT_HEADER);	/* MAC-OK */
-	if (m && IPV6_MMTU >= MHLEN)
+	MGETHDR(m, M_DONTWAIT, MT_HEADER);      /* MAC-OK */
+	if (m && IPV6_MMTU >= MHLEN) {
 		MCLGET(m, M_DONTWAIT);
-	if (!m)
+	}
+	if (!m) {
 		goto fail;
+	}
 	m->m_pkthdr.rcvif = NULL;
 	m->m_len = 0;
 	maxlen = M_TRAILINGSPACE(m);
-	maxlen = min(IPV6_MMTU, maxlen);
+	maxlen = MIN(IPV6_MMTU, maxlen);
 	/* just for safety */
 	if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) +
 	    ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) {
@@ -2639,9 +2799,10 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 		/* get ip6 linklocal address for ifp(my outgoing interface). */
 		struct in6_ifaddr *ia;
 		if ((ia = in6ifa_ifpforlinklocal(ifp,
-						 IN6_IFF_NOTREADY|
-						 IN6_IFF_ANYCAST)) == NULL)
+		    IN6_IFF_NOTREADY |
+		    IN6_IFF_ANYCAST)) == NULL) {
 			goto fail;
+		}
 		IFA_LOCK(&ia->ia_ifa);
 		ifp_ll6 = ia->ia_addr.sin6_addr;
 		IFA_UNLOCK(&ia->ia_ifa);
@@ -2653,10 +2814,12 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 		struct sockaddr_in6 *sin6;
 		sin6 = (struct sockaddr_in6 *)(void *)rt->rt_gateway;
 		router_ll6 = &sin6->sin6_addr;
-		if (!IN6_IS_ADDR_LINKLOCAL(router_ll6))
+		if (!IN6_IS_ADDR_LINKLOCAL(router_ll6)) {
 			router_ll6 = (struct in6_addr *)NULL;
-	} else
+		}
+	} else {
 		router_ll6 = (struct in6_addr *)NULL;
+	}
 
 	/* ip6 */
 	ip6 = mtod(m, struct ip6_hdr *);
@@ -2665,7 +2828,7 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 	ip6->ip6_vfc |= IPV6_VERSION;
 	/* ip6->ip6_plen will be set later */
 	ip6->ip6_nxt = IPPROTO_ICMPV6;
-	ip6->ip6_hlim = 255;
+	ip6->ip6_hlim = IPV6_MAXHLIM;
 	/* ip6->ip6_src must be linklocal addr for my outgoing if. */
 	bcopy(&ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr));
 	bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr));
@@ -2680,26 +2843,28 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 		 * nd_rd->nd_rd_target must be a link-local address in
 		 * better router cases.
 		 */
-		if (!router_ll6)
+		if (!router_ll6) {
 			goto fail;
+		}
 		bcopy(router_ll6, &nd_rd->nd_rd_target,
-		      sizeof(nd_rd->nd_rd_target));
+		    sizeof(nd_rd->nd_rd_target));
 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
-		      sizeof(nd_rd->nd_rd_dst));
+		    sizeof(nd_rd->nd_rd_dst));
 	} else {
 		/* make sure redtgt == reddst */
 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
-		      sizeof(nd_rd->nd_rd_target));
+		    sizeof(nd_rd->nd_rd_target));
 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
-		      sizeof(nd_rd->nd_rd_dst));
+		    sizeof(nd_rd->nd_rd_dst));
 	}
 	RT_UNLOCK(rt);
 	rt = NULL;
 
 	p = (u_char *)(nd_rd + 1);
 
-	if (!router_ll6)
+	if (!router_ll6) {
 		goto nolladdropt;
+	}
 
 	{
 		/* target lladdr option */
@@ -2711,11 +2876,12 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 
 		/* Callee returns a locked route upon success */
 		rt_router = nd6_lookup(router_ll6, 0, ifp, 0);
-		if (!rt_router)
+		if (!rt_router) {
 			goto nolladdropt;
+		}
 		RT_LOCK_ASSERT_HELD(rt_router);
 		len = sizeof(*nd_opt) + ifp->if_addrlen;
-		len = (len + 7) & ~7;	/* round by 8 */
+		len = (len + 7) & ~7;   /* round by 8 */
 		/* safety check */
 		if (len + (p - (u_char *)ip6) > maxlen) {
 			RT_REMREF_LOCKED(rt_router);
@@ -2724,16 +2890,16 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 		}
 
 		if (!(rt_router->rt_flags & RTF_GATEWAY) &&
-			(rt_router->rt_flags & RTF_LLINFO) &&
-			(rt_router->rt_gateway->sa_family == AF_LINK) &&
-			(sdl = (struct sockaddr_dl *)(void *)
-			rt_router->rt_gateway) && sdl->sdl_alen) {
-				nd_opt = (struct nd_opt_hdr *)p;
-				nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
-				nd_opt->nd_opt_len = len >> 3;
-				lladdr = (char *)(nd_opt + 1);
-				bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
-				p += len;
+		    (rt_router->rt_flags & RTF_LLINFO) &&
+		    (rt_router->rt_gateway->sa_family == AF_LINK) &&
+		    (sdl = (struct sockaddr_dl *)(void *)
+		    rt_router->rt_gateway) && sdl->sdl_alen) {
+			nd_opt = (struct nd_opt_hdr *)p;
+			nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
+			nd_opt->nd_opt_len = (uint8_t)(len >> 3);
+			lladdr = (char *)(nd_opt + 1);
+			bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
+			p += len;
 		}
 		RT_REMREF_LOCKED(rt_router);
 		RT_UNLOCK(rt_router);
@@ -2741,85 +2907,88 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 
 nolladdropt:;
 
-	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
+	m->m_pkthdr.len = m->m_len = (int32_t)(p - (u_char *)ip6);
 
 	/* just to be safe */
-#ifdef M_DECRYPTED	/*not openbsd*/
-	if (m0->m_flags & M_DECRYPTED)
+#ifdef M_DECRYPTED      /*not openbsd*/
+	if (m0->m_flags & M_DECRYPTED) {
 		goto noredhdropt;
+	}
 #endif
-	if (p - (u_char *)ip6 > maxlen)
+	if (p - (u_char *)ip6 > maxlen) {
 		goto noredhdropt;
+	}
 
-    {
-	/* redirected header option */
-	int len;
-	struct nd_opt_rd_hdr *nd_opt_rh;
-
-	/*
-	 * compute the maximum size for icmp6 redirect header option.
-	 * XXX room for auth header?
-	 */
-	len = maxlen - (p - (u_char *)ip6);
-	len &= ~7;
+	{
+		/* redirected header option */
+		int len;
+		struct nd_opt_rd_hdr *nd_opt_rh;
 
-	/* This is just for simplicity. */
-	if (m0->m_pkthdr.len != m0->m_len) {
-		if (m0->m_next) {
-			m_freem(m0->m_next);
-			m0->m_next = NULL;
+		/*
+		 * compute the maximum size for icmp6 redirect header option.
+		 * XXX room for auth header?
+		 */
+		len = (int)(maxlen - (p - (u_char *)ip6));
+		len &= ~7;
+
+		/* This is just for simplicity. */
+		if (m0->m_pkthdr.len != m0->m_len) {
+			if (m0->m_next) {
+				m_freem(m0->m_next);
+				m0->m_next = NULL;
+			}
+			m0->m_pkthdr.len = m0->m_len;
 		}
-		m0->m_pkthdr.len = m0->m_len;
-	}
 
-	/*
-	 * Redirected header option spec (RFC2461 4.6.3) talks nothing
-	 * about padding/truncate rule for the original IP packet.
-	 * From the discussion on IPv6imp in Feb 1999, the consensus was:
-	 * - "attach as much as possible" is the goal
-	 * - pad if not aligned (original size can be guessed by original
-	 *   ip6 header)
-	 * Following code adds the padding if it is simple enough,
-	 * and truncates if not.
-	 */
-	if (m0->m_next || m0->m_pkthdr.len != m0->m_len)
-		panic("assumption failed in %s:%d\n", __FILE__, __LINE__);
+		/*
+		 * Redirected header option spec (RFC2461 4.6.3) talks nothing
+		 * about padding/truncate rule for the original IP packet.
+		 * From the discussion on IPv6imp in Feb 1999, the consensus was:
+		 * - "attach as much as possible" is the goal
+		 * - pad if not aligned (original size can be guessed by original
+		 *   ip6 header)
+		 * Following code adds the padding if it is simple enough,
+		 * and truncates if not.
+		 */
+		if (m0->m_next || m0->m_pkthdr.len != m0->m_len) {
+			panic("assumption failed in %s:%d\n", __func__, __LINE__);
+		}
 
-	if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
-		/* not enough room, truncate */
-		m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
-	} else {
-		/* enough room, pad or truncate */
-		size_t extra;
-
-		extra = m0->m_pkthdr.len % 8;
-		if (extra) {
-			/* pad if easy enough, truncate if not */
-			if (8 - extra <= M_TRAILINGSPACE(m0)) {
-				/* pad */
-				m0->m_len += (8 - extra);
-				m0->m_pkthdr.len += (8 - extra);
-			} else {
-				/* truncate */
-				m0->m_pkthdr.len -= extra;
-				m0->m_len -= extra;
+		if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
+			/* not enough room, truncate */
+			m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
+		} else {
+			/* enough room, pad or truncate */
+			size_t extra;
+
+			extra = m0->m_pkthdr.len % 8;
+			if (extra) {
+				/* pad if easy enough, truncate if not */
+				if (8 - extra <= M_TRAILINGSPACE(m0)) {
+					/* pad */
+					m0->m_len += (8 - extra);
+					m0->m_pkthdr.len += (8 - extra);
+				} else {
+					/* truncate */
+					m0->m_pkthdr.len -= extra;
+					m0->m_len -= extra;
+				}
 			}
+			len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
+			m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
 		}
-		len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
-		m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
-	}
 
-	nd_opt_rh = (struct nd_opt_rd_hdr *)p;
-	bzero(nd_opt_rh, sizeof(*nd_opt_rh));
-	nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
-	nd_opt_rh->nd_opt_rh_len = len >> 3;
-	p += sizeof(*nd_opt_rh);
-	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
+		nd_opt_rh = (struct nd_opt_rd_hdr *)p;
+		bzero(nd_opt_rh, sizeof(*nd_opt_rh));
+		nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
+		nd_opt_rh->nd_opt_rh_len = (uint8_t)(len >> 3);
+		p += sizeof(*nd_opt_rh);
+		m->m_pkthdr.len = m->m_len = (int32_t)(p - (u_char *)ip6);
 
-	/* connect m0 to m */
-	m->m_next = m0;
-	m->m_pkthdr.len = m->m_len + m0->m_len;
-    }
+		/* connect m0 to m */
+		m->m_next = m0;
+		m->m_pkthdr.len = m->m_len + m0->m_len;
+	}
 noredhdropt:;
 
 	/* XXX: clear embedded link IDs in the inner header */
@@ -2828,15 +2997,16 @@ noredhdropt:;
 	in6_clearscope(&nd_rd->nd_rd_target);
 	in6_clearscope(&nd_rd->nd_rd_dst);
 
-	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
+	ip6->ip6_plen = htons((uint16_t)(m->m_pkthdr.len - sizeof(struct ip6_hdr)));
 
 	nd_rd->nd_rd_cksum = 0;
 	nd_rd->nd_rd_cksum
-		= in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));
+	        = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));
 
 	/* send the packet to outside... */
 	ip6oa.ip6oa_boundif = ifp->if_index;
 	ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
+	ip6oa.ip6oa_flags |= IP6OAF_DONT_FRAG;
 
 	ip6_output(m, NULL, NULL, IPV6_OUTARGS, NULL, &outif, &ip6oa);
 	if (outif) {
@@ -2849,12 +3019,15 @@ noredhdropt:;
 	return;
 
 fail:
-	if (rt != NULL)
+	if (rt != NULL) {
 		RT_UNLOCK(rt);
-	if (m)
+	}
+	if (m) {
 		m_freem(m);
-	if (m0)
+	}
+	if (m0) {
 		m_freem(m0);
+	}
 }
 
 /*
@@ -2864,7 +3037,7 @@ int
 icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 {
 	int error = 0;
-	int optlen;
+	size_t optlen;
 	struct inpcb *inp = sotoinpcb(so);
 	int level, op, optname;
 
@@ -2873,8 +3046,9 @@ icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 		op = sopt->sopt_dir;
 		optname = sopt->sopt_name;
 		optlen = sopt->sopt_valsize;
-	} else
+	} else {
 		level = op = optname = optlen = 0;
+	}
 
 	if (level != IPPROTO_ICMPV6) {
 		return EINVAL;
@@ -2884,7 +3058,7 @@ icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 	case PRCO_SETOPT:
 		switch (optname) {
 		case ICMP6_FILTER:
-		    {
+		{
 			struct icmp6_filter *p;
 
 			if (optlen != 0 && optlen != sizeof(*p)) {
@@ -2897,17 +3071,17 @@ icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 			}
 
 			if (optlen == 0) {
-				/* According to RFC 3542, an installed filter can be 
+				/* According to RFC 3542, an installed filter can be
 				 * cleared by issuing a setsockopt for ICMP6_FILTER
 				 * with a zero length.
 				 */
 				ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
 			} else {
 				error = sooptcopyin(sopt, inp->in6p_icmp6filt, optlen,
-					optlen);
+				    optlen);
 			}
 			break;
-		    }
+		}
 
 		default:
 			error = ENOPROTOOPT;
@@ -2918,15 +3092,15 @@ icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 	case PRCO_GETOPT:
 		switch (optname) {
 		case ICMP6_FILTER:
-		    {
+		{
 			if (inp->in6p_icmp6filt == NULL) {
 				error = EINVAL;
 				break;
 			}
 			error = sooptcopyout(sopt, inp->in6p_icmp6filt,
-					min(sizeof(struct icmp6_filter), optlen));
+			    MIN(sizeof(struct icmp6_filter), optlen));
 			break;
-		    }
+		}
 
 		default:
 			error = ENOPROTOOPT;
@@ -2935,7 +3109,7 @@ icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 		break;
 	}
 
-	return(error);
+	return error;
 }
 
 /*
@@ -2944,56 +3118,58 @@ icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
 int
 icmp6_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
 {
-	if (kauth_cred_issuser(so->so_cred))
+	if (kauth_cred_issuser(so->so_cred)) {
 		return icmp6_ctloutput(so, sopt);
+	}
 
 	if (sopt->sopt_level == IPPROTO_ICMPV6) {
 		switch (sopt->sopt_name) {
-			case ICMP6_FILTER:
-				return icmp6_ctloutput(so, sopt);
-			default:
-				return EPERM;
+		case ICMP6_FILTER:
+			return icmp6_ctloutput(so, sopt);
+		default:
+			return EPERM;
 		}
 	}
 
-	if (sopt->sopt_level != IPPROTO_IPV6)
+	if (sopt->sopt_level != IPPROTO_IPV6) {
 		return EINVAL;
+	}
 
 	switch (sopt->sopt_name) {
-		case IPV6_UNICAST_HOPS:
-		case IPV6_CHECKSUM:
-		case IPV6_V6ONLY:
-		case IPV6_USE_MIN_MTU:
-		case IPV6_RECVRTHDR:
-		case IPV6_RECVPKTINFO:
-		case IPV6_RECVHOPLIMIT:
-		case IPV6_PATHMTU:
-		case IPV6_PKTINFO:
-		case IPV6_HOPLIMIT:
-		case IPV6_HOPOPTS:
-		case IPV6_DSTOPTS:
-		case IPV6_MULTICAST_IF:
-		case IPV6_MULTICAST_HOPS:
-		case IPV6_MULTICAST_LOOP:
-		case IPV6_JOIN_GROUP:
-		case IPV6_LEAVE_GROUP:
-		case IPV6_PORTRANGE:
-		case IPV6_IPSEC_POLICY:
-		case IPV6_RECVTCLASS:
-		case IPV6_TCLASS:
-		case IPV6_2292PKTOPTIONS:
-		case IPV6_2292PKTINFO:
-		case IPV6_2292HOPLIMIT:
-		case IPV6_2292HOPOPTS:
-		case IPV6_2292DSTOPTS:
-		case IPV6_2292RTHDR:
-		case IPV6_BOUND_IF:
-		case IPV6_NO_IFT_CELLULAR:
-
-			return ip6_ctloutput(so, sopt);
+	case IPV6_UNICAST_HOPS:
+	case IPV6_CHECKSUM:
+	case IPV6_V6ONLY:
+	case IPV6_USE_MIN_MTU:
+	case IPV6_RECVRTHDR:
+	case IPV6_RECVPKTINFO:
+	case IPV6_RECVHOPLIMIT:
+	case IPV6_PATHMTU:
+	case IPV6_PKTINFO:
+	case IPV6_HOPLIMIT:
+	case IPV6_HOPOPTS:
+	case IPV6_DSTOPTS:
+	case IPV6_MULTICAST_IF:
+	case IPV6_MULTICAST_HOPS:
+	case IPV6_MULTICAST_LOOP:
+	case IPV6_JOIN_GROUP:
+	case IPV6_LEAVE_GROUP:
+	case IPV6_PORTRANGE:
+	case IPV6_IPSEC_POLICY:
+	case IPV6_RECVTCLASS:
+	case IPV6_TCLASS:
+	case IPV6_2292PKTOPTIONS:
+	case IPV6_2292PKTINFO:
+	case IPV6_2292HOPLIMIT:
+	case IPV6_2292HOPOPTS:
+	case IPV6_2292DSTOPTS:
+	case IPV6_2292RTHDR:
+	case IPV6_BOUND_IF:
+	case IPV6_NO_IFT_CELLULAR:
+
+		return ip6_ctloutput(so, sopt);
 
-		default:
-			return EPERM;
+	default:
+		return EPERM;
 	}
 }
 
@@ -3004,42 +3180,19 @@ icmp6_dgram_send(struct socket *so, int flags, struct mbuf *m,
 #pragma unused(flags, p)
 	int error = 0;
 	struct inpcb *inp = sotoinpcb(so);
-	struct sockaddr_in6 tmp;
-	struct sockaddr_in6 *dst = (struct sockaddr_in6 *)(void *)nam;
 	struct icmp6_hdr *icmp6;
 
 	if (inp == NULL
 #if NECP
-		|| (necp_socket_should_use_flow_divert(inp))
+	    || (necp_socket_should_use_flow_divert(inp))
 #endif /* NECP */
-		) {
+	    ) {
 		error = (inp == NULL ? EINVAL : EPROTOTYPE);
 		goto bad;
 	}
 
-	if (kauth_cred_issuser(so->so_cred))
-		return (rip6_output(m, so, SIN6(nam), control, 0));
-
-	/* always copy sockaddr to avoid overwrites */
-	if (so->so_state & SS_ISCONNECTED) {
-		if (nam != NULL) {
-			error = EISCONN;
-			goto bad;
-		}
-		/* XXX */
-		bzero(&tmp, sizeof(tmp));
-		tmp.sin6_family = AF_INET6;
-		tmp.sin6_len = sizeof(struct sockaddr_in6);
-		bcopy(&inp->in6p_faddr, &tmp.sin6_addr,
-			  sizeof(struct in6_addr));
-		dst = &tmp;
-	} else {
-		if (nam == NULL) {
-			error = ENOTCONN;
-			goto bad;
-		}
-		tmp = *(struct sockaddr_in6 *)(void *)nam;
-		dst = &tmp;
+	if (kauth_cred_issuser(so->so_cred)) {
+		return rip6_output(m, so, SIN6(nam), control, 0);
 	}
 
 	/*
@@ -3047,9 +3200,9 @@ icmp6_dgram_send(struct socket *so, int flags, struct mbuf *m,
 	 */
 	if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
 		if (m->m_len < sizeof(struct icmp6_hdr) &&
-			(m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
-				error = ENOBUFS;
-				goto bad;
+		    (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
+			error = ENOBUFS;
+			goto bad;
 		}
 		icmp6 = mtod(m, struct icmp6_hdr *);
 
@@ -3070,55 +3223,56 @@ icmp6_dgram_send(struct socket *so, int flags, struct mbuf *m,
 		}
 	}
 
-#if ENABLE_DEFAULT_SCOPE
-	if (dst->sin6_scope_id == 0) {  /* not change if specified  */
-		dst->sin6_scope_id = scope6_addr2default(&dst->sin6_addr);
-	}
-#endif
-
-	return (rip6_output(m, so, dst, control, 0));
+	return rip6_output(m, so, SIN6(nam), control, 0);
 bad:
 	VERIFY(error != 0);
 
-	if (m != NULL)
+	if (m != NULL) {
 		m_freem(m);
-	if (control != NULL)
+	}
+	if (control != NULL) {
 		m_freem(control);
+	}
 
-	return (error);
+	return error;
 }
 
 /* Like rip6_attach but without root privilege enforcement */
 __private_extern__ int
 icmp6_dgram_attach(struct socket *so, int proto, struct proc *p)
 {
-        struct inpcb *inp;
-        int error;
-
-        inp = sotoinpcb(so);
-        if (inp)
-                panic("icmp6_dgram_attach");
-
-		if (proto != IPPROTO_ICMPV6)
-			return EINVAL;
-
-        error = soreserve(so, rip_sendspace, rip_recvspace);
-        if (error)
-                return error;
-        error = in_pcballoc(so, &ripcbinfo, p);
-        if (error)
-                return error;
-        inp = (struct inpcb *)so->so_pcb;
-        inp->inp_vflag |= INP_IPV6;
-        inp->in6p_ip6_nxt = IPPROTO_ICMPV6;
-        inp->in6p_hops = -1;    /* use kernel default */
-        inp->in6p_cksum = -1;
-        MALLOC(inp->in6p_icmp6filt, struct icmp6_filter *,
-               sizeof(struct icmp6_filter), M_PCB, M_WAITOK);
-        if (inp->in6p_icmp6filt == NULL)
-                return (ENOMEM);
-        ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
-        return 0;
+	struct inpcb *inp;
+	int error;
+
+	inp = sotoinpcb(so);
+	if (inp) {
+		panic("icmp6_dgram_attach");
+	}
+
+	if (proto != IPPROTO_ICMPV6) {
+		return EINVAL;
+	}
+
+	error = soreserve(so, rip_sendspace, rip_recvspace);
+	if (error) {
+		return error;
+	}
+	error = in_pcballoc(so, &ripcbinfo, p);
+	if (error) {
+		return error;
+	}
+	inp = (struct inpcb *)so->so_pcb;
+	inp->inp_vflag |= INP_IPV6;
+	inp->in6p_ip6_nxt = IPPROTO_ICMPV6;
+	inp->in6p_hops = -1;    /* use kernel default */
+	inp->in6p_cksum = -1;
+	MALLOC(inp->in6p_icmp6filt, struct icmp6_filter *,
+	    sizeof(struct icmp6_filter), M_PCB, M_WAITOK);
+	if (inp->in6p_icmp6filt == NULL) {
+		return ENOMEM;
+	}
+	ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
+	return 0;
 }
 
 
@@ -3132,23 +3286,33 @@ icmp6_dgram_attach(struct socket *so, int proto, struct proc *p)
  */
 static int
 icmp6_ratelimit(
-	__unused const struct in6_addr *dst,	/* not used at this moment */
+	__unused const struct in6_addr *dst,    /* not used at this moment */
 	const int type,
 	__unused const int code)
 {
 	int ret;
 
-	ret = 0;	/* okay to send */
+	ret = 0;        /* okay to send */
 
 	/* PPS limit */
 	if (type == ND_ROUTER_ADVERT) {
 		if (!ppsratecheck(&icmp6rappslim_last, &icmp6rapps_count,
-		    icmp6rappslim))
+		    icmp6rappslim)) {
 			ret++;
+		}
 	} else if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count,
 	    icmp6errppslim)) {
-		/* The packet is subject to rate limit */
-		ret++;
+		/*
+		 * We add some randomness here to still generate ICMPv6 error
+		 * post icmp6errppslim limit with a probability that goes down
+		 * with increased value of icmp6errpps_count.
+		 */
+		if (icmp6errpps_count > 0 && icmp6errppslim > 0 &&
+		    icmp6errpps_count > icmp6errppslim &&
+		    (random() % (icmp6errpps_count - icmp6errppslim)) != 0) {
+			/* The packet is subject to rate limit */
+			ret++;
+		}
 	}
 
 	return ret;