--- nd6.c.orig	2014-10-13 16:22:14.000000000 +0100
+++ nd6.c	2014-10-14 10:33:16.000000000 +0100
@@ -875,6 +875,8 @@
 {
 	struct nd_prefix *pr;
 	struct ifaddr *dstaddr;
+	struct rtentry *rt;
+	int retval;
 
 	/*
 	 * A link-local address is always a neighbor.
@@ -910,8 +912,6 @@
 			continue;
 
 		if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) {
-			struct rtentry *rt;
-
 			/* Always use the default FIB here. */
 			rt = in6_rtalloc1((struct sockaddr *)&pr->ndpr_prefix,
 			    0, 0, RT_DEFAULT_FIB);
@@ -963,7 +963,21 @@
 		return (1);
 	}
 
-	return (0);
+	/* Check for a matching non static route which userland may have
+	 * added. This is the only check we can make because RTF_CLONING
+	 * was dropped. */
+	rt = in6_rtalloc1((struct sockaddr *)addr, 0, 0, RT_DEFAULT_FIB);
+	if (rt == NULL)
+		return (0);
+	if (!(rt->rt_flags & RTF_STATIC) &&
+	    (rt->rt_ifp == ifp ||
+	    rt->rt_ifp->if_bridge == ifp->if_bridge))
+	    /* XXX Check matching carp device? */
+		retval = 1;
+	else
+		retval = 0;
+	RTFREE_LOCKED(rt);
+	return (retval);
 }