MFC r236501 (by emax):

MFC r236501 (by emax):

  Plug reference leak.

  Interface addresses are refcounted as packets move through the stack,
  and there's garbage collection tied to it so that address changes can
  safely propagate while traffic is flowing. In our setup, we weren't
  changing or deleting any addresses, but the refcounting logic in
  ip6_input() was wrong and caused a reference leak on every inbound
  V6 packet. This eventually caused a 32bit overflow, and the resulting
  0 value caused the garbage collection to run on the active address.
  That then snowballed into the panic.

git-svn-id: svn://svn.freebsd.org/base/stable/8@236609 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f