From a3da8329c509a002908602175cd7507fc10d4f6c Mon Sep 17 00:00:00 2001
From: Gleb Smirnoff <glebius@FreeBSD.org>
Date: Mon, 17 Oct 2022 11:39:40 -0700
Subject: [PATCH] carp: fix regression panic from ccd69bd573f

Reported & tested by:	Oleg Ginzburg <olevole olevole.ru>
Fixes:			ccd69bd573f185308e7652190ff64b50f7fba381
---
 sys/netinet6/nd6_nbr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
index 7bca7fa59ac..cd7119c9ccb 100644
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -514,7 +514,8 @@ nd6_ns_output_fib(struct ifnet *ifp, const struct in6_addr *saddr6,
 			 * Do not send NS for CARP address if we are not
 			 * the CARP master.
 			 */
-			if (ifa != NULL && !(*carp_master_p)(ifa)) {
+			if (ifa != NULL && ifa->ifa_carp != NULL &&
+			    !(*carp_master_p)(ifa)) {
 				log(LOG_DEBUG,
 				    "nd6_ns_output: NS from BACKUP CARP address %s\n",
 				    ip6_sprintf(ip6buf, &ip6->ip6_src));