>>	My question is, who makes sure that the entry is still there on
>>	the call to icmp_mtudisc_timeout(), usually happens 10min later?
>>	My imagination was that icmp_mtudisc() would increase reference count
>>	on the route entry for that (by NOT calling rtfree()), but the
>>	implemented behavior does not match my imagination.  Could someone
>>	let me know the trick? (or am I lucky?)
>The timeout call is associated with the route, so it gets deleted if
>the route gets deleted.  That way, everything is fine, no matter what
>what the state of the routing table.

	Hmm, rt_timer_remove_all() called from rtfree() does the trick.
	Sorry I did not notice this.  Thanks!

itojun