panic in in6_ifdetach()

[Don Lewis]

I was testing one of Warner's patches on my laptop and found that it
paniced during boot.  The trigger was that fxp0 couldn't gets its irq
configured in fxp_attach(), so it called ether_ifdetach(), which
eventually ended up calling in6_ifdetach(), which blew up at the line of
code marked below:

        /* remove route to link-local allnodes multicast (ff02::1) */
        bzero(&sin6, sizeof(sin6));
        sin6.sin6_len = sizeof(struct sockaddr_in6);
        sin6.sin6_family = AF_INET6;
        sin6.sin6_addr = in6addr_linklocal_allnodes;
        sin6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
        /* XXX grab lock first to avoid LOR */
--->    RADIX_NODE_HEAD_LOCK(rt_tables[AF_INET6]);
        rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
        if (rt) {
                if (rt->rt_ifp == ifp)
                        rtexpunge(rt);
                RTFREE_LOCKED(rt);
        }
        RADIX_NODE_HEAD_UNLOCK(rt_tables[AF_INET6]);

The problem is that during boot time the hardware is getting attached
well before route_init() is called, which is what initializes
rt_tables[].

It looks like the allnodes multicast address is not configured for the
interface until it is given an IPv6 address, so there should be no need
to remove the route until that has happened.

Any suggestions for a non-kludgey way to fix this?