Index: sys/net/route.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/net/route.c,v
diff -u -p -u -p -r1.440 route.c
--- sys/net/route.c	16 Feb 2025 11:39:28 -0000	1.440
+++ sys/net/route.c	16 Feb 2025 14:37:27 -0000
@@ -324,7 +324,8 @@ rtisvalid(struct rtentry *rt)
 		return (0);
 
 	if (ISSET(rt->rt_flags, RTF_GATEWAY)) {
-		KASSERT(rt->rt_gwroute != NULL);
+		if (rt->rt_gwroute == NULL)
+			return (0);
 		KASSERT(!ISSET(rt->rt_gwroute->rt_flags, RTF_GATEWAY));
 		if (!ISSET(rt->rt_gwroute->rt_flags, RTF_UP))
 			return (0);
@@ -1163,7 +1164,11 @@ struct rtentry *
 rt_getll(struct rtentry *rt)
 {
 	if (ISSET(rt->rt_flags, RTF_GATEWAY)) {
-		KASSERT(rt->rt_gwroute != NULL);
+	 	/*
+		 * While rtrequest_delete() is setting rt_gwroute to NULL,
+		 * RTF_GATEWAY is set and another thread is using the route.
+		 * We may return NULL here.
+		 */
 		return (rt->rt_gwroute);
 	}
 
Index: sys/netinet/if_ether.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/if_ether.c,v
diff -u -p -u -p -r1.270 if_ether.c
--- sys/netinet/if_ether.c	16 Feb 2025 11:39:28 -0000	1.270
+++ sys/netinet/if_ether.c	16 Feb 2025 14:37:27 -0000
@@ -354,8 +354,8 @@ arpresolve(struct ifnet *ifp, struct rte
 	uptime = getuptime();
 	rt = rt_getll(rt0);
 
-	if (ISSET(rt->rt_flags, RTF_REJECT) &&
-	    (rt->rt_expire == 0 || rt->rt_expire > uptime)) {
+	if (rt == NULL || (ISSET(rt->rt_flags, RTF_REJECT) &&
+	    (rt->rt_expire == 0 || rt->rt_expire > uptime))) {
 		m_freem(m);
 		return (rt == rt0 ? EHOSTDOWN : EHOSTUNREACH);
 	}
Index: sys/netinet6/nd6.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet6/nd6.c,v
diff -u -p -u -p -r1.286 nd6.c
--- sys/netinet6/nd6.c	16 Feb 2025 11:39:28 -0000	1.286
+++ sys/netinet6/nd6.c	16 Feb 2025 14:37:27 -0000
@@ -1285,8 +1285,8 @@ nd6_resolve(struct ifnet *ifp, struct rt
 	uptime = getuptime();
 	rt = rt_getll(rt0);
 
-	if (ISSET(rt->rt_flags, RTF_REJECT) &&
-	    (rt->rt_expire == 0 || rt->rt_expire > uptime)) {
+	if (rt == NULL || (ISSET(rt->rt_flags, RTF_REJECT) &&
+	    (rt->rt_expire == 0 || rt->rt_expire > uptime))) {
 		m_freem(m);
 		return (rt == rt0 ? EHOSTDOWN : EHOSTUNREACH);
 	}