ndp -P => panic: prefix 0xfffff80011c56700 has referencing addresses

[Ryan Stone]

# ifconfig vtnet0 inet6 1::1
# ndp -P
panic: prefix 0xfffff80011c56700 has referencing addresses
cpuid = 1
time = 1591991817
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0022d08720
vpanic() at vpanic+0x19d/frame 0xfffffe0022d08770
panic() at panic+0x43/frame 0xfffffe0022d087d0
nd6_prefix_del() at nd6_prefix_del+0x1e7/frame 0xfffffe0022d08840
nd6_ioctl() at nd6_ioctl+0x5a8/frame 0xfffffe0022d088c0
ifioctl() at ifioctl+0x574/frame 0xfffffe0022d08990
kern_ioctl() at kern_ioctl+0x295/frame 0xfffffe0022d089f0
sys_ioctl() at sys_ioctl+0x15d/frame 0xfffffe0022d08ac0
amd64_syscall() at amd64_syscall+0x2b9/frame 0xfffffe0022d08bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0022d08bf0
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x80041929a, rsp =
0x7fffffffe748, rbp = 0x7fffffffec00 ---

Looking at the code handling the SIOCSPFXFLUSH_IN6 ioctl(), it's clear
that it's just trying to free every nd_prefix (excepting link-local
prefixes), but what's less clear to me is what this should do instead.
Should this only flush prefixes learned through NDP RAs?  What do we
do if a non-autoconf address is assigned from such a prefix?