> Unless I'm mistaken, glancing over rtrequest1(), I think the code
> already does this.  When the more specific route is deleted, the
> rt_entry referenced by the cache has its RTF_UP cleared and this is
> noticed in ip_output().

I'm not so sure.  How is the cached route located and where is its
RTF_UP cleared?  The route being deleted has its RTF_UP cleared, but
that's not the one ipforward_rt points to; unless the route is to a /32
or the packet is to the all-0 host portion, it can't be - the cached
route always has the exact /32 as its destination.

...Or Am I Missing Something?

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B