--- kernel/bsd/net/rtsock.c	2018/04/24 18:26:07	1.1.1.1
+++ kernel/bsd/net/rtsock.c	2018/04/24 18:31:45	1.1.1.2
@@ -220,7 +220,8 @@ route_output(m, so)
 		error = rtrequest(RTM_DELETE, dst, gate, netmask,
 				rtm->rtm_flags, &saved_nrt);
 		if (error == 0) {
-			(rt = saved_nrt)->rt_refcnt++;
+			rt = saved_nrt;
+			RTHOLD(rt);
 			goto report;
 		}
 		break;
@@ -232,7 +233,7 @@ route_output(m, so)
 			senderr(EAFNOSUPPORT);
 		} else if (rt = (struct rtentry *)
 				rnh->rnh_lookup(dst, netmask, rnh))
-			rt->rt_refcnt++;
+			RTHOLD(rt)
 		else
 			senderr(ESRCH);
 		switch(rtm->rtm_type) {
@@ -296,7 +297,8 @@ route_output(m, so)
 								rt, gate);
 				    IFAFREE(rt->rt_ifa);
 				    rt->rt_ifa = ifa;
-				    ifa->ifa_refcnt++;
+				    if (++ifa->ifa_refcnt <= 0)
+					panic("route_output ifa_refcnt");
 				    rt->rt_ifp = ifp;
 				}
 			}