--- kernel/bsd/net/route.c	2018/04/24 18:26:07	1.1
+++ kernel/bsd/net/route.c	2018/04/24 18:31:47	1.1.1.2
@@ -142,7 +142,7 @@ rtalloc1(dst, report)
 					      SA(0), 0, &newrt);
 			if (err) {
 				newrt = rt;
-				rt->rt_refcnt++;
+				RTHOLD(rt);
 				goto miss;
 			}
 			if ((rt = newrt) && (rt->rt_flags & RTF_XRESOLVE)) {
@@ -150,7 +150,7 @@ rtalloc1(dst, report)
 				goto miss;
 			}
 		} else
-			rt->rt_refcnt++;
+			RTHOLD(rt);
 	} else {
 		rtstat.rts_unreach++;
 	miss:	if (report) {
@@ -393,7 +393,7 @@ rtrequest(req, dst, gateway, netmask, fl
 		if (ret_nrt)
 			*ret_nrt = rt;
 		else if (rt->rt_refcnt <= 0) {
-			rt->rt_refcnt++;
+			RTHOLD(rt);
 			rtfree(rt);
 		}
 		break;
@@ -435,7 +435,8 @@ rtrequest(req, dst, gateway, netmask, fl
 			Free(rt);
 			senderr(EEXIST);
 		}
-		ifa->ifa_refcnt++;
+                if (++ifa->ifa_refcnt <= 0)
+                        panic("rtrequest ifa_refcnt");
 		rt->rt_ifa = ifa;
 		rt->rt_ifp = ifa->ifa_ifp;
 		if (req == RTM_RESOLVE)
@@ -444,7 +445,7 @@ rtrequest(req, dst, gateway, netmask, fl
 			ifa->ifa_rtrequest(req, rt, SA(ret_nrt ? *ret_nrt : 0));
 		if (ret_nrt) {
 			*ret_nrt = rt;
-			rt->rt_refcnt++;
+			RTHOLD(rt);
 		}
 		break;
 	}
@@ -548,7 +549,7 @@ rtinit(ifa, cmd, flags)
 	if (cmd == RTM_DELETE && error == 0 && (rt = nrt)) {
 		rt_newaddrmsg(cmd, ifa, error, nrt);
 		if (rt->rt_refcnt <= 0) {
-			rt->rt_refcnt++;
+			RTHOLD(rt);
 			rtfree(rt);
 		}
 	}
@@ -562,7 +563,8 @@ rtinit(ifa, cmd, flags)
 			IFAFREE(rt->rt_ifa);
 			rt->rt_ifa = ifa;
 			rt->rt_ifp = ifa->ifa_ifp;
-			ifa->ifa_refcnt++;
+                	if (++ifa->ifa_refcnt <= 0)
+                        	panic("rtinit ifa_refcnt");
 			if (ifa->ifa_rtrequest)
 			    ifa->ifa_rtrequest(RTM_ADD, rt, SA(0));
 		}