Really fix ipfilter bug 3600459.

Obtained from:	ipfilter cvs repo r1.48.2.25, r1.72 and NetBSD repo r1.4
MFC after:	3 days

diff --git a/sys/contrib/ipfilter/netinet/ip_state.c b/sys/contrib/ipfilter/netinet/ip_state.c
index a3930ea69fc4fc6638a700cede5cda279d8c7225..2ceec3262ec9f8aae89fe93408695ff7fc2ea478 100644 (file)
--- a/sys/contrib/ipfilter/netinet/ip_state.c
+++ b/sys/contrib/ipfilter/netinet/ip_state.c
@@ -3650,7 +3650,6 @@ ipf_state_del(softc, is, why)
        if (is->is_ref > 0) {
                int refs;
 
-               is->is_ref--;
                refs = is->is_ref;
                MUTEX_EXIT(&is->is_lock);
                if (!orphan)
@@ -3667,7 +3666,7 @@ ipf_state_del(softc, is, why)
                }
        }
 
-       is->is_ref = 0;
+       ASSERT(is->is_ref == 0);
        MUTEX_EXIT(&is->is_lock);
 
        if (is->is_tqehead[0] != NULL) {