See sys/net/route.h, the definition of RTFREE.  'struct rtentry' is
already refcounted.

I think the more important point is that if a route is removed from
the routing table, it is a cache consistency violation for it to still
be held by a socket or anywhere else.

I'm not certain, but I think the following might work to maintain
cache consistency:

  When removing a route, clear any pointer to that route in any
  socket or elsewhere (e.g. the global route cache).

  Argument: If a route is the best match, then if some other route is
  removed, it must still be the best match.

  When adding a route X, clear any cached pointer to a route Y if X is
  more specific than Y and X and Y match to the length of Y's prefix.

  Argument: for other routes Z for which this is not true, if a packet
  matched Z, it couldn't match X, and thus X couldn't be the best
  match.

  With 'struct route' in pcbs, this is a bit simpler: clear any cached
  pointer if the cached address falls within the new route.

-- 
        Greg Troxel <gdt@ir.bbn.com>