Index: sys/netinet6/nd6.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet6/nd6.c,v
diff -u -p -u -p -r1.283 nd6.c
--- sys/netinet6/nd6.c	4 Sep 2024 07:54:52 -0000	1.283
+++ sys/netinet6/nd6.c	29 Jan 2025 20:21:02 -0000
@@ -709,21 +709,25 @@ nd6_nud_hint(struct rtentry *rt)
 	struct llinfo_nd6 *ln;
 	struct ifnet *ifp;
 
-	NET_ASSERT_LOCKED_EXCLUSIVE();
-
-	ifp = if_get(rt->rt_ifidx);
-	if (ifp == NULL)
-		return;
+	NET_ASSERT_LOCKED();
 
 	if ((rt->rt_flags & RTF_GATEWAY) != 0 ||
 	    (rt->rt_flags & RTF_LLINFO) == 0 ||
-	    rt->rt_llinfo == NULL || rt->rt_gateway == NULL ||
+	    rt->rt_gateway == NULL ||
 	    rt->rt_gateway->sa_family != AF_LINK) {
 		/* This is not a host route. */
-		goto out;
+		return;
 	}
 
+	ifp = if_get(rt->rt_ifidx);
+	if (ifp == NULL)
+		return;
+
+	mtx_enter(&nd6_mtx);
+
 	ln = (struct llinfo_nd6 *)rt->rt_llinfo;
+	if (ln == NULL)
+		goto out;
 	if (ln->ln_state < ND6_LLINFO_REACHABLE)
 		goto out;
 
@@ -739,6 +743,7 @@ nd6_nud_hint(struct rtentry *rt)
 	if (!ND6_LLINFO_PERMANENT(ln))
 		nd6_llinfo_settimer(ln, ifp->if_nd->reachable);
 out:
+	mtx_leave(&nd6_mtx);
 	if_put(ifp);
 }