Index: sys/net/route.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/net/route.c,v
diff -u -p -u -p -r1.438 route.c
--- sys/net/route.c	3 Jan 2025 21:27:40 -0000	1.438
+++ sys/net/route.c	6 Feb 2025 20:29:21 -0000
@@ -324,10 +324,13 @@ rtisvalid(struct rtentry *rt)
 		return (0);
 
 	if (ISSET(rt->rt_flags, RTF_GATEWAY)) {
-		KASSERT(rt->rt_gwroute != NULL);
-		KASSERT(!ISSET(rt->rt_gwroute->rt_flags, RTF_GATEWAY));
-		if (!ISSET(rt->rt_gwroute->rt_flags, RTF_UP))
-			return (0);
+		struct rtentry *gwrt = READ_ONCE(rt->rt_gwroute);
+
+		if (gwrt != NULL) {
+			KASSERT(!ISSET(gwrt->rt_flags, RTF_GATEWAY));
+			if (!ISSET(gwrt->rt_flags, RTF_UP))
+				return (0);
+		}
 	}
 
 	return (1);
@@ -803,7 +806,9 @@ rtdeletemsg(struct rtentry *rt, struct i
 	info.rti_flags = rt->rt_flags;
 	info.rti_info[RTAX_IFP] = sdltosa(ifp->if_sadl);
 	info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
+	KERNEL_LOCK();
 	error = rtrequest_delete(&info, rt->rt_priority, ifp, &rt, tableid);
+	KERNEL_UNLOCK();
 	rtm_miss(RTM_DELETE, &info, info.rti_flags, rt->rt_priority,
 	    rt->rt_ifidx, error, tableid);
 	if (error == 0)
@@ -1060,7 +1065,9 @@ rtrequest(int req, struct rt_addrinfo *i
 		    tableid))) {
 			ifafree(ifa);
 			rtfree(rt->rt_parent);
+			KERNEL_LOCK();
 			rt_putgwroute(rt, NULL);
+			KERNEL_UNLOCK();
 			if (rt->rt_gateway != NULL) {
 				free(rt->rt_gateway, M_RTABLE,
 				    ROUNDUP(rt->rt_gateway->sa_len));
@@ -1095,7 +1102,9 @@ rtrequest(int req, struct rt_addrinfo *i
 		if (error != 0) {
 			ifafree(ifa);
 			rtfree(rt->rt_parent);
+			KERNEL_LOCK();
 			rt_putgwroute(rt, NULL);
+			KERNEL_UNLOCK();
 			if (rt->rt_gateway != NULL) {
 				free(rt->rt_gateway, M_RTABLE,
 				    ROUNDUP(rt->rt_gateway->sa_len));
@@ -1163,8 +1172,10 @@ struct rtentry *
 rt_getll(struct rtentry *rt)
 {
 	if (ISSET(rt->rt_flags, RTF_GATEWAY)) {
-		KASSERT(rt->rt_gwroute != NULL);
-		return (rt->rt_gwroute);
+		struct rtentry *gwrt = READ_ONCE(rt->rt_gwroute);
+
+		if (gwrt != NULL)
+			return (gwrt);
 	}
 
 	return (rt);
@@ -1333,7 +1344,9 @@ rt_ifa_del(struct ifaddr *ifa, int flags
 		prio = ifp->if_priority + RTP_CONNECTED;
 
 	rtable_clearsource(rdomain, ifa->ifa_addr);
+	KERNEL_LOCK();
 	error = rtrequest_delete(&info, prio, ifp, &rt, rdomain);
+	KERNEL_UNLOCK();
 	if (error == 0) {
 		rtm_send(rt, RTM_DELETE, 0, rdomain);
 		if (flags & RTF_LOCAL)
Index: sys/netinet6/nd6_rtr.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet6/nd6_rtr.c,v
diff -u -p -u -p -r1.171 nd6_rtr.c
--- sys/netinet6/nd6_rtr.c	14 Jul 2024 18:53:39 -0000	1.171
+++ sys/netinet6/nd6_rtr.c	6 Feb 2025 20:29:21 -0000
@@ -204,8 +204,10 @@ rt6_flush(struct in6_addr *gateway, stru
 			info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
 			info.rti_info[RTAX_NETMASK] = rt_plen2mask(rt,
 			    &sa_mask);
+			KERNEL_LOCK();
 			error = rtrequest_delete(&info, RTP_ANY, ifp, NULL,
 			    ifp->if_rdomain);
+			KERNEL_UNLOCK();
 			if (error == 0)
 				error = EAGAIN;
 		}