diff --git a/sys/dist/pf/net/pf_osfp.c b/sys/dist/pf/net/pf_osfp.c
index 4db9a39d269a..137e11b7a187 100644
--- a/sys/dist/pf/net/pf_osfp.c
+++ b/sys/dist/pf/net/pf_osfp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pf_osfp.c,v 1.11 2011/05/18 12:54:15 drochner Exp $	*/
+/*	$NetBSD: pf_osfp.c,v 1.12 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$OpenBSD: pf_osfp.c,v 1.12 2006/12/13 18:14:10 itojun Exp $ */
 
 /*
@@ -19,7 +19,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pf_osfp.c,v 1.11 2011/05/18 12:54:15 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pf_osfp.c,v 1.12 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -172,9 +172,8 @@ pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6, const st
 		fp.fp_flags |= PF_OSFP_DF;
 		fp.fp_flags |= PF_OSFP_INET6;
 #ifdef _KERNEL
-		strlcpy(srcname,
-		    ip6_sprintf((const struct in6_addr *)&ip6->ip6_src),
-		    sizeof(srcname));
+		CTASSERT(sizeof(srcname) >= INET6_ADDRSTRLEN);
+		ip6_sprintf(srcname, (const struct in6_addr *)&ip6->ip6_src);
 #else
 		memset(&sin6, 0, sizeof(sin6));
 		sin6.sin6_family = AF_INET6;
diff --git a/sys/net/if_spppsubr.c b/sys/net/if_spppsubr.c
index 87afec5932a8..8d4c9fc74801 100644
--- a/sys/net/if_spppsubr.c
+++ b/sys/net/if_spppsubr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_spppsubr.c,v 1.165 2016/12/27 13:49:58 christos Exp $	 */
+/*	$NetBSD: if_spppsubr.c,v 1.166 2017/01/16 07:33:36 ryo Exp $	 */
 
 /*
  * Synchronous PPP/Cisco link level subroutines.
@@ -41,7 +41,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.165 2016/12/27 13:49:58 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_spppsubr.c,v 1.166 2017/01/16 07:33:36 ryo Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -3584,6 +3584,7 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 	int ifidcount;
 	int type;
 	int collision, nohisaddr;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	KASSERT(sppp_locked(sp));
 
@@ -3690,7 +3691,7 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 
 				if (debug) {
 					addlog(" %s [%s]",
-					    ip6_sprintf(&desiredaddr),
+					    ip6_sprintf(ip6buf, &desiredaddr),
 					    sppp_cp_type_name(type));
 				}
 				continue;
@@ -3712,7 +3713,7 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 				memcpy(&p[2], &suggestaddr.s6_addr[8], 8);
 			}
 			if (debug)
-				addlog(" %s [%s]", ip6_sprintf(&desiredaddr),
+				addlog(" %s [%s]", ip6_sprintf(ip6buf, &desiredaddr),
 				    sppp_cp_type_name(type));
 			break;
 		}
@@ -3739,7 +3740,7 @@ sppp_ipv6cp_RCR(struct sppp *sp, struct lcp_header *h, int len)
 
 		if (debug) {
 			addlog(" send %s suggest %s\n",
-			    sppp_cp_type_name(type), ip6_sprintf(&suggestaddr));
+			    sppp_cp_type_name(type), ip6_sprintf(ip6buf, &suggestaddr));
 		}
 		sppp_cp_send(sp, PPP_IPV6CP, type, h->ident, rlen, buf);
 	}
@@ -3818,6 +3819,7 @@ sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
 	struct ifnet *ifp = &sp->pp_if;
 	int debug = ifp->if_flags & IFF_DEBUG;
 	struct in6_addr suggestaddr;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	KASSERT(sppp_locked(sp));
 
@@ -3857,7 +3859,7 @@ sppp_ipv6cp_RCN_nak(struct sppp *sp, struct lcp_header *h, int len)
 			sp->ipv6cp.opts |= (1 << IPV6CP_OPT_IFID);
 			if (debug)
 				addlog(" [suggestaddr %s]",
-				       ip6_sprintf(&suggestaddr));
+				       ip6_sprintf(ip6buf, &suggestaddr));
 #ifdef IPV6CP_MYIFID_DYN
 			/*
 			 * When doing dynamic address assignment,
diff --git a/sys/netinet/dccp_usrreq.c b/sys/netinet/dccp_usrreq.c
index e53f74e36ec9..1ac35891658f 100644
--- a/sys/netinet/dccp_usrreq.c
+++ b/sys/netinet/dccp_usrreq.c
@@ -1,5 +1,5 @@
 /*	$KAME: dccp_usrreq.c,v 1.67 2005/11/03 16:05:04 nishida Exp $	*/
-/*	$NetBSD: dccp_usrreq.c,v 1.10 2016/12/13 08:29:03 ozaki-r Exp $ */
+/*	$NetBSD: dccp_usrreq.c,v 1.11 2017/01/16 07:33:36 ryo Exp $ */
 
 /*
  * Copyright (c) 2003 Joacim Häggmark, Magnus Erixzon, Nils-Erik Mattsson 
@@ -67,7 +67,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: dccp_usrreq.c,v 1.10 2016/12/13 08:29:03 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: dccp_usrreq.c,v 1.11 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -377,11 +377,12 @@ dccp_input(struct mbuf *m, ...)
 
 #ifdef INET6
 			if (isipv6) {
+				char ip6buf[INET6_ADDRSTRLEN];
 				strlcpy(dbuf, "[", sizeof dbuf);
-				strlcat(dbuf, ip6_sprintf(&ip6->ip6_dst), sizeof dbuf);
+				strlcat(dbuf, ip6_sprintf(ip6buf, &ip6->ip6_dst), sizeof dbuf);
 				strlcat(dbuf, "]", sizeof dbuf);
 				strlcpy(sbuf, "[", sizeof sbuf);
-				strlcat(sbuf, ip6_sprintf(&ip6->ip6_src), sizeof sbuf);
+				strlcat(sbuf, ip6_sprintf(ip6buf, &ip6->ip6_src), sizeof sbuf);
 				strlcat(sbuf, "]", sizeof sbuf);
 			} else
 #endif
diff --git a/sys/netinet/if_arp.c b/sys/netinet/if_arp.c
index 4bd2140ba9af..0148125a866e 100644
--- a/sys/netinet/if_arp.c
+++ b/sys/netinet/if_arp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_arp.c,v 1.233 2016/12/12 03:55:57 ozaki-r Exp $	*/
+/*	$NetBSD: if_arp.c,v 1.234 2017/01/16 07:33:36 ryo Exp $	*/
 
 /*-
  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.233 2016/12/12 03:55:57 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.234 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ddb.h"
@@ -221,34 +221,30 @@ static int log_unknown_network = 1;
  * this should be elsewhere.
  */
 
-static char *
-lla_snprintf(u_int8_t *, int);
+#define	LLA_ADDRSTRLEN	(16 * 3)
 
 static char *
-lla_snprintf(u_int8_t *adrp, int len)
+lla_snprintf(char *, u_int8_t *, int);
+
+static char *
+lla_snprintf(char *dst, u_int8_t *adrp, int len)
 {
-#define NUMBUFS 3
-	static char buf[NUMBUFS][16*3];
-	static int bnum = 0;
-
 	int i;
 	char *p;
 
-	p = buf[bnum];
+	p = dst;
 
-	*p++ = hexdigits[(*adrp)>>4];
-	*p++ = hexdigits[(*adrp++)&0xf];
+	*p++ = hexdigits[(*adrp) >> 4];
+	*p++ = hexdigits[(*adrp++) & 0xf];
 
-	for (i=1; i<len && i<16; i++) {
+	for (i = 1; i < len && i < 16; i++) {
 		*p++ = ':';
-		*p++ = hexdigits[(*adrp)>>4];
-		*p++ = hexdigits[(*adrp++)&0xf];
+		*p++ = hexdigits[(*adrp) >> 4];
+		*p++ = hexdigits[(*adrp++) & 0xf];
 	}
 
 	*p = 0;
-	p = buf[bnum];
-	bnum = (bnum + 1) % NUMBUFS;
-	return p;
+	return dst;
 }
 
 DOMAIN_DEFINE(arpdomain);	/* forward declare and add to link set */
@@ -693,9 +689,10 @@ arpannounce(struct ifnet *ifp, struct ifaddr *ifa, const uint8_t *enaddr)
 {
 	struct in_ifaddr *ia = ifatoia(ifa);
 	struct in_addr *ip = &IA_SIN(ifa)->sin_addr;
+	char ipbuf[INET_ADDRSTRLEN];
 
 	if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED)) {
-		arplog(LOG_DEBUG, "%s not ready\n", in_fmtaddr(*ip));
+		arplog(LOG_DEBUG, "%s not ready\n", in_fmtaddr(ipbuf, *ip));
 		return;
 	}
 	arprequest(ifp, ip, ip, enaddr);
@@ -1016,6 +1013,8 @@ in_arpinput(struct mbuf *m)
 	uint64_t *arps;
 	struct psref psref, psref_ia;
 	int s;
+	char llabuf[LLA_ADDRSTRLEN];
+	char ipbuf[INET_ADDRSTRLEN];
 
 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
 		goto out;
@@ -1125,7 +1124,7 @@ in_arpinput(struct mbuf *m)
 		ARP_STATINC(ARP_STAT_RCVBCASTSHA);
 		log(LOG_ERR,
 		    "%s: arp: link address is broadcast for IP address %s!\n",
-		    ifp->if_xname, in_fmtaddr(isaddr));
+		    ifp->if_xname, in_fmtaddr(ipbuf, isaddr));
 		goto out;
 	}
 
@@ -1152,7 +1151,7 @@ in_arpinput(struct mbuf *m)
 	    (in_nullhost(isaddr) && in_hosteq(itaddr, myaddr)))
 	{
 		arp_dad_duplicated((struct ifaddr *)ia,
-		    lla_snprintf(ar_sha(ah), ah->ar_hln));
+		    lla_snprintf(llabuf, ar_sha(ah), ah->ar_hln));
 		goto out;
 	}
 
@@ -1175,8 +1174,8 @@ in_arpinput(struct mbuf *m)
 			log(LOG_INFO,
 			    "%s tried to overwrite permanent arp info"
 			    " for %s\n",
-			    lla_snprintf(ar_sha(ah), ah->ar_hln),
-			    in_fmtaddr(isaddr));
+			    lla_snprintf(llabuf, ar_sha(ah), ah->ar_hln),
+			    in_fmtaddr(ipbuf, isaddr));
 			goto out;
 		} else if (la->lle_tbl->llt_ifp != ifp) {
 			/* XXX should not happen? */
@@ -1186,8 +1185,8 @@ in_arpinput(struct mbuf *m)
 			log(LOG_INFO,
 			    "%s on %s tried to overwrite "
 			    "arp info for %s on %s\n",
-			    lla_snprintf(ar_sha(ah), ah->ar_hln),
-			    ifp->if_xname, in_fmtaddr(isaddr),
+			    lla_snprintf(llabuf, ar_sha(ah), ah->ar_hln),
+			    ifp->if_xname, in_fmtaddr(ipbuf, isaddr),
 			    la->lle_tbl->llt_ifp->if_xname);
 				goto out;
 		} else {
@@ -1195,8 +1194,8 @@ in_arpinput(struct mbuf *m)
 			if (log_movements)
 				log(LOG_INFO, "arp info overwritten "
 				    "for %s by %s\n",
-				    in_fmtaddr(isaddr),
-				    lla_snprintf(ar_sha(ah),
+				    in_fmtaddr(ipbuf, isaddr),
+				    lla_snprintf(llabuf, ar_sha(ah),
 				    ah->ar_hln));
 		}
 	}
@@ -1212,7 +1211,7 @@ in_arpinput(struct mbuf *m)
 		ARP_STATINC(ARP_STAT_RCVLENCHG);
 		log(LOG_WARNING,
 		    "arp from %s: new addr len %d, was %d\n",
-		    in_fmtaddr(isaddr), ah->ar_hln, sdl->sdl_alen);
+		    in_fmtaddr(ipbuf, isaddr), ah->ar_hln, sdl->sdl_alen);
 	}
 #endif
 
@@ -1220,7 +1219,7 @@ in_arpinput(struct mbuf *m)
 		ARP_STATINC(ARP_STAT_RCVBADLEN);
 		log(LOG_WARNING,
 		    "arp from %s: addr len: new %d, i/f %d (ignored)\n",
-		    in_fmtaddr(isaddr), ah->ar_hln,
+		    in_fmtaddr(ipbuf, isaddr), ah->ar_hln,
 		    ifp->if_addrlen);
 		goto reply;
 	}
@@ -1574,6 +1573,7 @@ arp_dad_start(struct ifaddr *ifa)
 {
 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
 	struct dadq *dp;
+	char ipbuf[INET_ADDRSTRLEN];
 
 	if (!dad_init) {
 		TAILQ_INIT(&dadq);
@@ -1588,7 +1588,7 @@ arp_dad_start(struct ifaddr *ifa)
 	if (!(ia->ia4_flags & IN_IFF_TENTATIVE)) {
 		log(LOG_DEBUG,
 		    "%s: called with non-tentative address %s(%s)\n", __func__,
-		    in_fmtaddr(ia->ia_addr.sin_addr),
+		    in_fmtaddr(ipbuf, ia->ia_addr.sin_addr),
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
 	}
@@ -1613,7 +1613,7 @@ arp_dad_start(struct ifaddr *ifa)
 	if (dp == NULL) {
 		mutex_exit(&arp_dad_lock);
 		log(LOG_ERR, "%s: memory allocation failed for %s(%s)\n",
-		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
+		    __func__, in_fmtaddr(ipbuf, ia->ia_addr.sin_addr),
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
 	}
@@ -1632,7 +1632,7 @@ arp_dad_start(struct ifaddr *ifa)
 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
 
 	arplog(LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
-	    in_fmtaddr(ia->ia_addr.sin_addr));
+	    in_fmtaddr(ipbuf, ia->ia_addr.sin_addr));
 
 	arp_dad_starttimer(dp, cprng_fast32() % (PROBE_WAIT * hz));
 
@@ -1674,6 +1674,7 @@ arp_dad_timer(struct ifaddr *ifa)
 {
 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
 	struct dadq *dp;
+	char ipbuf[INET_ADDRSTRLEN];
 
 	mutex_enter(softnet_lock);
 	KERNEL_LOCK(1, NULL);
@@ -1691,14 +1692,14 @@ arp_dad_timer(struct ifaddr *ifa)
 	}
 	if (ia->ia4_flags & IN_IFF_DUPLICATED) {
 		log(LOG_ERR, "%s: called with duplicate address %s(%s)\n",
-		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
+		    __func__, in_fmtaddr(ipbuf, ia->ia_addr.sin_addr),
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		goto done;
 	}
 	if ((ia->ia4_flags & IN_IFF_TENTATIVE) == 0 && dp->dad_arp_acount == 0)
 	{
 		log(LOG_ERR, "%s: called with non-tentative address %s(%s)\n",
-		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
+		    __func__, in_fmtaddr(ipbuf, ia->ia_addr.sin_addr),
 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		goto done;
 	}
@@ -1741,7 +1742,7 @@ arp_dad_timer(struct ifaddr *ifa)
 		arplog(LOG_DEBUG,
 		    "%s: DAD complete for %s - no duplicates found\n",
 		    if_name(ifa->ifa_ifp),
-		    in_fmtaddr(ia->ia_addr.sin_addr));
+		    in_fmtaddr(ipbuf, ia->ia_addr.sin_addr));
 		dp->dad_arp_announce = ANNOUNCE_NUM;
 		goto announce;
 	} else if (dp->dad_arp_acount < dp->dad_arp_announce) {
@@ -1758,7 +1759,7 @@ announce:
 		arplog(LOG_DEBUG,
 		    "%s: ARP announcement complete for %s\n",
 		    if_name(ifa->ifa_ifp),
-		    in_fmtaddr(ia->ia_addr.sin_addr));
+		    in_fmtaddr(ipbuf, ia->ia_addr.sin_addr));
 	}
 
 	TAILQ_REMOVE(&dadq, dp, dad_list);
@@ -1777,7 +1778,10 @@ arp_dad_duplicated(struct ifaddr *ifa, const char *sha)
 {
 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
 	struct ifnet *ifp = ifa->ifa_ifp;
-	const char *iastr = in_fmtaddr(ia->ia_addr.sin_addr);
+	char ipbuf[INET_ADDRSTRLEN];
+	const char *iastr;
+
+	iastr = in_fmtaddr(ipbuf, ia->ia_addr.sin_addr);
 
 	if (ia->ia4_flags & (IN_IFF_TENTATIVE|IN_IFF_DUPLICATED)) {
 		log(LOG_ERR,
diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index a1d4541a0e5f..8ed8e984b0b1 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: in.c,v 1.195 2017/01/02 23:00:25 christos Exp $	*/
+/*	$NetBSD: in.c,v 1.196 2017/01/16 07:33:36 ryo Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in.c,v 1.195 2017/01/02 23:00:25 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in.c,v 1.196 2017/01/16 07:33:36 ryo Exp $");
 
 #include "arp.h"
 
@@ -297,19 +297,18 @@ in_socktrim(struct sockaddr_in *ap)
 /*
  *  Routine to take an Internet address and convert into a
  *  "dotted quad" representation for printing.
+ *  Caller has to make sure that buf is at least INET_ADDRSTRLEN long.
  */
 const char *
-in_fmtaddr(struct in_addr addr)
+in_fmtaddr(char *buf, struct in_addr addr)
 {
-	static char buf[sizeof("123.456.789.123")];
-
 	addr.s_addr = ntohl(addr.s_addr);
 
-	snprintf(buf, sizeof(buf), "%d.%d.%d.%d",
-		(addr.s_addr >> 24) & 0xFF,
-		(addr.s_addr >> 16) & 0xFF,
-		(addr.s_addr >>  8) & 0xFF,
-		(addr.s_addr >>  0) & 0xFF);
+	snprintf(buf, INET_ADDRSTRLEN, "%d.%d.%d.%d",
+	    (addr.s_addr >> 24) & 0xFF,
+	    (addr.s_addr >> 16) & 0xFF,
+	    (addr.s_addr >>  8) & 0xFF,
+	    (addr.s_addr >>  0) & 0xFF);
 	return buf;
 }
 
diff --git a/sys/netinet/in_var.h b/sys/netinet/in_var.h
index 75508a12e3c3..8a7cb0c99ed2 100644
--- a/sys/netinet/in_var.h
+++ b/sys/netinet/in_var.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: in_var.h,v 1.91 2017/01/02 23:00:25 christos Exp $	*/
+/*	$NetBSD: in_var.h,v 1.92 2017/01/16 07:33:36 ryo Exp $	*/
 
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -414,7 +414,7 @@ void	in_savemkludge(struct in_ifaddr *);
 void	in_restoremkludge(struct in_ifaddr *, struct ifnet *);
 void	in_purgemkludge(struct ifnet *);
 void	in_setmaxmtu(void);
-const char *in_fmtaddr(struct in_addr);
+const char *in_fmtaddr(char *, struct in_addr);
 int	in_control(struct socket *, u_long, void *, struct ifnet *);
 void	in_purgeaddr(struct ifaddr *);
 void	in_purgeif(struct ifnet *);
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
index f4837cd4ea72..80c83e9057ff 100644
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_carp.c,v 1.81 2016/12/28 07:26:25 ozaki-r Exp $	*/
+/*	$NetBSD: ip_carp.c,v 1.82 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$OpenBSD: ip_carp.c,v 1.113 2005/11/04 08:11:54 mcbride Exp $	*/
 
 /*
@@ -33,7 +33,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_carp.c,v 1.81 2016/12/28 07:26:25 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_carp.c,v 1.82 2017/01/16 07:33:36 ryo Exp $");
 
 /*
  * TODO:
@@ -690,22 +690,23 @@ carp_proto_input_c(struct mbuf *m, struct carp_header *ch, sa_family_t af)
 	if (carp_hmac_verify(sc, ch->carp_counter, ch->carp_md)) {
 		struct ip *ip;
 		struct ip6_hdr *ip6;
+		char ip6buf[INET6_ADDRSTRLEN];
+		char ipbuf[INET_ADDRSTRLEN];
 
 		CARP_STATINC(CARP_STAT_BADAUTH);
 		sc->sc_if.if_ierrors++;
 
 		switch(af) {
-		
 		case AF_INET:
 			ip = mtod(m, struct ip *);
 			CARP_LOG(sc, ("incorrect hash from %s", 
-			    in_fmtaddr(ip->ip_src)));
+			    in_fmtaddr(ipbuf, ip->ip_src)));
 			break;
 
 		case AF_INET6:
 			ip6 = mtod(m, struct ip6_hdr *);
 			CARP_LOG(sc, ("incorrect hash from %s",
-				ip6_sprintf(&ip6->ip6_src)));
+			    ip6_sprintf(ip6buf, &ip6->ip6_src)));
 			break;
 
 		default: CARP_LOG(sc, ("incorrect hash"));
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 999021f454b2..fcdd6138e7c1 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_output.c,v 1.267 2017/01/11 13:08:29 ozaki-r Exp $	*/
+/*	$NetBSD: ip_output.c,v 1.268 2017/01/16 07:33:36 ryo Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.267 2017/01/11 13:08:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.268 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -620,9 +620,10 @@ sendit:
 	if ((ia != NULL || (flags & IP_FORWARDING) == 0) &&
 	    (error = ip_ifaddrvalid(ia)) != 0)
 	{
+		char ipbuf[INET_ADDRSTRLEN];
 		arplog(LOG_ERR,
 		    "refusing to send from invalid address %s (pid %d)\n",
-		    in_fmtaddr(ip->ip_src), curproc->p_pid);
+		    in_fmtaddr(ipbuf, ip->ip_src), curproc->p_pid);
 		IP_STATINC(IP_STAT_ODROPPED);
 		if (error == 1)
 			/*
diff --git a/sys/netinet/sctp_asconf.c b/sys/netinet/sctp_asconf.c
index 93efd8c6f1e9..1c5e2adcc759 100644
--- a/sys/netinet/sctp_asconf.c
+++ b/sys/netinet/sctp_asconf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sctp_asconf.c,v 1.7 2016/12/15 03:54:15 ozaki-r Exp $ */
+/*	$NetBSD: sctp_asconf.c,v 1.8 2017/01/16 07:33:36 ryo Exp $ */
 /*	$KAME: sctp_asconf.c,v 1.25 2005/06/16 20:44:24 jinmei Exp $	*/
 
 /*
@@ -30,7 +30,7 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp_asconf.c,v 1.7 2016/12/15 03:54:15 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp_asconf.c,v 1.8 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -967,6 +967,9 @@ sctp_asconf_queue_add(struct sctp_tcb *stcb, struct ifaddr *ifa, uint16_t type)
 	/* correlation_id filled in during send routine later... */
 	if (ifa->ifa_addr->sa_family == AF_INET6) {
 		/* IPv6 address */
+#ifdef SCTP_DEBUG
+		char ip6buf[INET6_ADDRSTRLEN];
+#endif
 		struct sockaddr_in6 *sin6;
 
 		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
@@ -978,7 +981,7 @@ sctp_asconf_queue_add(struct sctp_tcb *stcb, struct ifaddr *ifa, uint16_t type)
 		memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
 		    sizeof(struct in6_addr));
 #ifdef SCTP_DEBUG
-		strlcpy(buf, ip6_sprintf(&sin6->sin6_addr), sizeof(buf));
+		strlcpy(buf, ip6_sprintf(ip6buf, &sin6->sin6_addr), sizeof(buf));
 #endif /* SCTP_DEBUG */
 
 	} else if (ifa->ifa_addr->sa_family == AF_INET) {
@@ -1664,11 +1667,12 @@ sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 	 * note: this would leave the address on both inp and asoc lists
 	 */
 	if (ifa->ifa_addr->sa_family == AF_INET6) {
+		char ip6buf[INET6_ADDRSTRLEN];
 		struct sockaddr_in6 *sin6;
 
 		sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
 #ifdef SCTP_DEBUG
-		strlcpy(buf, ip6_sprintf(&sin6->sin6_addr), sizeof(buf));
+		strlcpy(buf, ip6_sprintf(ip6buf, &sin6->sin6_addr), sizeof(buf));
 #endif /* SCTP_DEBUG */
 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 			/* we skip unspecifed addresses */
diff --git a/sys/netinet/sctputil.c b/sys/netinet/sctputil.c
index d526d112600c..80451b4add9c 100644
--- a/sys/netinet/sctputil.c
+++ b/sys/netinet/sctputil.c
@@ -1,5 +1,5 @@
 /*	$KAME: sctputil.c,v 1.39 2005/06/16 20:54:06 jinmei Exp $	*/
-/*	$NetBSD: sctputil.c,v 1.10 2016/07/07 09:32:02 ozaki-r Exp $	*/
+/*	$NetBSD: sctputil.c,v 1.11 2017/01/16 07:33:36 ryo Exp $	*/
 
 /*
  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -34,7 +34,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctputil.c,v 1.10 2016/07/07 09:32:02 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctputil.c,v 1.11 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -3048,12 +3048,13 @@ sctp_cmpaddr(const struct sockaddr *sa1, const struct sockaddr *sa2)
 void
 sctp_print_address(const struct sockaddr *sa)
 {
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	if (sa->sa_family == AF_INET6) {
 		const struct sockaddr_in6 *sin6;
 		sin6 = (const struct sockaddr_in6 *)sa;
 		printf("IPv6 address: %s:%d scope:%u\n",
-		    ip6_sprintf(&sin6->sin6_addr), ntohs(sin6->sin6_port),
+		    ip6_sprintf(ip6buf, &sin6->sin6_addr), ntohs(sin6->sin6_port),
 		    sin6->sin6_scope_id);
 	} else if (sa->sa_family == AF_INET) {
 		const struct sockaddr_in *sin;
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c
index 7445629c595b..5fceaefdf94f 100644
--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: icmp6.c,v 1.204 2017/01/13 10:38:37 ozaki-r Exp $	*/
+/*	$NetBSD: icmp6.c,v 1.205 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.204 2017/01/13 10:38:37 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.205 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -154,7 +154,7 @@ static int icmp6_redirect_lowat = -1;
 static void icmp6_errcount(u_int, int, int);
 static int icmp6_rip6_input(struct mbuf **, int);
 static int icmp6_ratelimit(const struct in6_addr *, const int, const int);
-static const char *icmp6_redirect_diag(struct in6_addr *,
+static const char *icmp6_redirect_diag(char *, size_t, struct in6_addr *,
 	struct in6_addr *, struct in6_addr *);
 static struct mbuf *ni6_input(struct mbuf *, int);
 static struct mbuf *ni6_nametodns(const char *, int, int);
@@ -455,6 +455,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 	int code, sum, noff;
 	struct ifnet *rcvif;
 	struct psref psref;
+	char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN];
 
 	rcvif = m_get_rcvif_psref(m, &psref);
 	if (__predict_false(rcvif == NULL))
@@ -503,7 +504,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 	 */
 	if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
 		nd6log(LOG_ERR, "ICMP6 checksum error(%d|%x) %s\n",
-		    icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src));
+		    icmp6->icmp6_type, sum, ip6_sprintf(ip6buf, &ip6->ip6_src));
 		ICMP6_STATINC(ICMP6_STAT_CHECKSUM);
 		icmp6_ifstat_inc(rcvif, ifs6_in_error);
 		goto freeit;
@@ -860,9 +861,11 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		break;
 
 	default:
-		nd6log(LOG_DEBUG, "unknown type %d(src=%s, dst=%s, ifid=%d)\n",
-		    icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src),
-		    ip6_sprintf(&ip6->ip6_dst),
+		nd6log(LOG_DEBUG,
+		    "unknown type %d(src=%s, dst=%s, ifid=%d)\n",
+		    icmp6->icmp6_type,
+		    ip6_sprintf(ip6buf, &ip6->ip6_src),
+		    ip6_sprintf(ip6buf2, &ip6->ip6_dst),
 		    rcvif ? rcvif->if_index : 0);
 		if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
 			/* ICMPv6 error: MUST deliver it by spec... */
@@ -2129,10 +2132,11 @@ icmp6_reflect(struct mbuf *m, size_t off)
 		    &ip6->ip6_src);
 		rtcache_free(&ro);
 		if (e != 0) {
+			char ip6buf[INET6_ADDRSTRLEN];
 			nd6log(LOG_DEBUG,
 			    "source can't be determined: "
 			    "dst=%s, error=%d\n",
-			    ip6_sprintf(&sin6.sin6_addr), e);
+			    ip6_sprintf(ip6buf, &sin6.sin6_addr), e);
 			goto bad;
 		}
 	}
@@ -2180,12 +2184,15 @@ icmp6_reflect(struct mbuf *m, size_t off)
 }
 
 static const char *
-icmp6_redirect_diag(struct in6_addr *src6, struct in6_addr *dst6, 
+icmp6_redirect_diag(char *buf, size_t buflen, struct in6_addr *src6, struct in6_addr *dst6, 
 	struct in6_addr *tgt6)
 {
-	static char buf[1024];
-	snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
-		ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
+	char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
+	char ip6buft[INET6_ADDRSTRLEN];
+
+	snprintf(buf, buflen, "(src=%s dst=%s tgt=%s)",
+	    ip6_sprintf(ip6bufs, src6), ip6_sprintf(ip6bufd, dst6),
+	    ip6_sprintf(ip6buft, tgt6));
 	return buf;
 }
 
@@ -2206,6 +2213,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	struct in6_addr reddst6;
 	union nd_opts ndopts;
 	struct psref psref;
+	char ip6buf[INET6_ADDRSTRLEN];
+	char diagbuf[256];
 
 	ifp = m_get_rcvif_psref(m, &psref);
 	if (ifp == NULL)
@@ -2235,14 +2244,14 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
 		nd6log(LOG_ERR,
 		    "ICMP6 redirect sent from %s rejected; "
-		    "must be from linklocal\n", ip6_sprintf(&src6));
+		    "must be from linklocal\n", ip6_sprintf(ip6buf, &src6));
 		goto bad;
 	}
 	if (ip6->ip6_hlim != 255) {
 		nd6log(LOG_ERR,
 		    "ICMP6 redirect sent from %s rejected; "
 		    "hlim=%d (must be 255)\n",
-		    ip6_sprintf(&src6), ip6->ip6_hlim);
+		    ip6_sprintf(ip6buf, &src6), ip6->ip6_hlim);
 		goto bad;
 	}
     {
@@ -2258,7 +2267,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 			nd6log(LOG_ERR,
 			    "ICMP6 redirect rejected; no route "
 			    "with inet6 gateway found for redirect dst: %s\n",
-			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+			    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+			    &src6, &reddst6, &redtgt6));
 			rt_unref(rt);
 			goto bad;
 		}
@@ -2268,15 +2278,17 @@ icmp6_redirect_input(struct mbuf *m, int off)
 			nd6log(LOG_ERR,
 			    "ICMP6 redirect rejected; "
 			    "not equal to gw-for-src=%s (must be same): %s\n",
-			    ip6_sprintf(gw6),
-			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+			    ip6_sprintf(ip6buf, gw6),
+			    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+			    &src6, &reddst6, &redtgt6));
 			rt_unref(rt);
 			goto bad;
 		}
 	} else {
 		nd6log(LOG_ERR, "ICMP6 redirect rejected; "
 		    "no route found for redirect dst: %s\n",
-		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+		    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+		    &src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 	rt_unref(rt);
@@ -2285,7 +2297,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
 		nd6log(LOG_ERR, "ICMP6 redirect rejected; "
 		    "redirect dst must be unicast: %s\n",
-		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+		    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+		    &src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 
@@ -2297,7 +2310,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	if (!is_router && !is_onlink) {
 		nd6log(LOG_ERR, "ICMP6 redirect rejected; "
 		    "neither router case nor onlink case: %s\n",
-		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+		    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+		    &src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 	/* validation passed */
@@ -2306,7 +2320,8 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
 	if (nd6_options(&ndopts) < 0) {
 		nd6log(LOG_INFO, "invalid ND option, rejected: %s\n",
-		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+		    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+		    &src6, &reddst6, &redtgt6));
 		/* nd6_options have incremented stats */
 		goto freeit;
 	}
@@ -2319,8 +2334,10 @@ icmp6_redirect_input(struct mbuf *m, int off)
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
 		    "(if %d, icmp6 packet %d): %s\n",
-		    ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
-		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
+		    ip6_sprintf(ip6buf, &redtgt6),
+		    ifp->if_addrlen, lladdrlen - 2,
+		    icmp6_redirect_diag(diagbuf, sizeof(diagbuf),
+		    &src6, &reddst6, &redtgt6));
 		goto bad;
 	}
 
diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index a53ae9b5c914..cb89212167f2 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: in6.c,v 1.233 2017/01/12 04:43:59 ozaki-r Exp $	*/
+/*	$NetBSD: in6.c,v 1.234 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: in6.c,v 1.198 2001/07/18 09:12:38 itojun Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in6.c,v 1.233 2017/01/12 04:43:59 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in6.c,v 1.234 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -796,6 +796,7 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 	struct rtentry *rt;
 	int dad_delay, was_tentative;
 	struct in6_ifaddr *ia = iap ? *iap : NULL;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	KASSERT((iap == NULL && psref == NULL) ||
 	    (iap != NULL && psref != NULL));
@@ -913,7 +914,7 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 		 * configuration mistake or a tool's bug.
 		 */
 		nd6log(LOG_INFO, "valid lifetime is 0 for %s\n",
-		    ip6_sprintf(&ifra->ifra_addr.sin6_addr));
+		    ip6_sprintf(ip6buf, &ifra->ifra_addr.sin6_addr));
 
 		if (ia == NULL)
 			return 0; /* there's nothing to do */
@@ -973,7 +974,8 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 				nd6log(LOG_INFO, "the prefix length of an"
 				    " existing (%s) autoconf address should"
 				    " not be changed\n",
-				    ip6_sprintf(&ia->ia_addr.sin6_addr));
+				    ip6_sprintf(ip6buf,
+				    &ia->ia_addr.sin6_addr));
 				error = EINVAL;
 				if (hostIsNew)
 					free(ia, M_IFADDR);
@@ -1107,7 +1109,7 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 		if (!imm) {
 			nd6log(LOG_ERR,
 			    "addmulti failed for %s on %s (errno=%d)\n",
-			    ip6_sprintf(&llsol), if_name(ifp), error);
+			    ip6_sprintf(ip6buf, &llsol), if_name(ifp), error);
 			goto cleanup;
 		}
 		LIST_INSERT_HEAD(&ia->ia6_memberships, imm, i6mm_chain);
@@ -1168,7 +1170,7 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 		if (!imm) {
 			nd6log(LOG_WARNING,
 			    "addmulti failed for %s on %s (errno=%d)\n",
-			    ip6_sprintf(&mltaddr.sin6_addr),
+			    ip6_sprintf(ip6buf, &mltaddr.sin6_addr),
 			    if_name(ifp), error);
 			goto cleanup;
 		}
@@ -1192,7 +1194,7 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 		          dad_delay)) == NULL) { /* XXX jinmei */
 			nd6log(LOG_WARNING,
 			    "addmulti failed for %s on %s (errno=%d)\n",
-			    ip6_sprintf(&mltaddr.sin6_addr),
+			    ip6_sprintf(ip6buf, &mltaddr.sin6_addr),
 			    if_name(ifp), error);
 			/* XXX not very fatal, go on... */
 		} else {
@@ -1249,7 +1251,7 @@ in6_update_ifa1(struct ifnet *ifp, struct in6_aliasreq *ifra,
 		if (!imm) {
 			nd6log(LOG_WARNING,
 			    "addmulti failed for %s on %s (errno=%d)\n",
-			    ip6_sprintf(&mltaddr.sin6_addr),
+			    ip6_sprintf(ip6buf, &mltaddr.sin6_addr),
 			    if_name(ifp), error);
 			goto cleanup;
 		} else {
@@ -1874,16 +1876,13 @@ bestia(struct in6_ifaddr *best_ia, struct in6_ifaddr *ia)
 
 /*
  * Convert IP6 address to printable (loggable) representation.
+ * Caller has to make sure that ip6buf is at least INET6_ADDRSTRLEN long.
  */
 char *
-ip6_sprintf(const struct in6_addr *addr)
+ip6_sprintf(char *ip6buf, const struct in6_addr *addr)
 {
-	static int ip6round = 0;
-	static char ip6buf[8][INET6_ADDRSTRLEN];
-	char *cp = ip6buf[ip6round++ & 7];
-
-	in6_print(cp, INET6_ADDRSTRLEN, addr);
-	return cp;
+	in6_print(ip6buf, INET6_ADDRSTRLEN, addr);
+	return ip6buf;
 }
 
 /*
@@ -2103,6 +2102,7 @@ in6_if_link_up(struct ifnet *ifp)
 	struct ifaddr *ifa;
 	struct in6_ifaddr *ia;
 	int s, bound;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	/* Ensure it's sane to run DAD */
 	if (ifp->if_link_state == LINK_STATE_DOWN)
@@ -2128,7 +2128,8 @@ in6_if_link_up(struct ifnet *ifp)
 			if (if_do_dad(ifp)) {
 				ia->ia6_flags |= IN6_IFF_TENTATIVE;
 				nd6log(LOG_ERR, "%s marked tentative\n",
-				    ip6_sprintf(&ia->ia_addr.sin6_addr));
+				    ip6_sprintf(ip6buf,
+				    &ia->ia_addr.sin6_addr));
 			} else if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0)
 				rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
 		}
@@ -2185,6 +2186,7 @@ in6_if_link_down(struct ifnet *ifp)
 	struct ifaddr *ifa;
 	struct in6_ifaddr *ia;
 	int s, bound;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	/* Any prefixes on this interface should be detached as well */
 	ND6_WLOCK();
@@ -2216,7 +2218,7 @@ in6_if_link_down(struct ifnet *ifp)
 		 */
 		if (!(ia->ia6_flags & IN6_IFF_DETACHED)) {
 			nd6log(LOG_DEBUG, "%s marked detached\n",
-			    ip6_sprintf(&ia->ia_addr.sin6_addr));
+			    ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr));
 			ia->ia6_flags |= IN6_IFF_DETACHED;
 			ia->ia6_flags &=
 			    ~(IN6_IFF_TENTATIVE | IN6_IFF_DUPLICATED);
@@ -2420,6 +2422,7 @@ in6_lltable_rtcheck(struct ifnet *ifp,
 		    const struct sockaddr *l3addr)
 {
 	struct rtentry *rt;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	KASSERTMSG(l3addr->sa_family == AF_INET6,
 	    "sin_family %d", l3addr->sa_family);
@@ -2443,7 +2446,8 @@ in6_lltable_rtcheck(struct ifnet *ifp,
 		}
 		pserialize_read_exit(s);
 		log(LOG_INFO, "IPv6 address: \"%s\" is not on the network\n",
-		    ip6_sprintf(&((const struct sockaddr_in6 *)l3addr)->sin6_addr));
+		    ip6_sprintf(ip6buf,
+		    &((const struct sockaddr_in6 *)l3addr)->sin6_addr));
 		if (rt != NULL)
 			rt_unref(rt);
 		return EINVAL;
diff --git a/sys/netinet6/in6_gif.c b/sys/netinet6/in6_gif.c
index a423b887e21f..90a1d2d73202 100644
--- a/sys/netinet6/in6_gif.c
+++ b/sys/netinet6/in6_gif.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: in6_gif.c,v 1.83 2017/01/06 03:25:13 knakahara Exp $	*/
+/*	$NetBSD: in6_gif.c,v 1.84 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: in6_gif.c,v 1.62 2001/07/29 04:27:25 itojun Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in6_gif.c,v 1.83 2017/01/06 03:25:13 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in6_gif.c,v 1.84 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -327,9 +327,10 @@ gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
 		rt = rtalloc1(&u.sa, 0);
 		if (rt == NULL || rt->rt_ifp != ifp) {
 #if 0
+			char ip6buf[INET6_ADDRSTRLEN];
 			log(LOG_WARNING, "%s: packet from %s dropped "
 			    "due to ingress filter\n", if_name(&sc->gif_if),
-			    ip6_sprintf(&u.sin6.sin6_addr));
+			    ip6_sprintf(ip6buf, &u.sin6.sin6_addr));
 #endif
 			if (rt != NULL)
 				rt_unref(rt);
diff --git a/sys/netinet6/in6_src.c b/sys/netinet6/in6_src.c
index cbd71cded38d..18c61481f5e7 100644
--- a/sys/netinet6/in6_src.c
+++ b/sys/netinet6/in6_src.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: in6_src.c,v 1.76 2016/12/08 05:16:34 ozaki-r Exp $	*/
+/*	$NetBSD: in6_src.c,v 1.77 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: in6_src.c,v 1.159 2005/10/19 01:40:32 t-momose Exp $	*/
 
 /*
@@ -66,7 +66,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in6_src.c,v 1.76 2016/12/08 05:16:34 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in6_src.c,v 1.77 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -606,11 +606,13 @@ in6_selectroute(struct sockaddr_in6 *dstsock, struct ip6_pktopts *opts,
 	if (dstsock->sin6_addr.s6_addr32[0] == 0 &&
 	    dstsock->sin6_addr.s6_addr32[1] == 0 &&
 	    !IN6_IS_ADDR_LOOPBACK(&dstsock->sin6_addr)) {
+		char ip6buf[INET6_ADDRSTRLEN];
 		printf("in6_selectroute: strange destination %s\n",
-		       ip6_sprintf(&dstsock->sin6_addr));
+		       ip6_sprintf(ip6buf, &dstsock->sin6_addr));
 	} else {
+		char ip6buf[INET6_ADDRSTRLEN];
 		printf("in6_selectroute: destination = %s%%%d\n",
-		       ip6_sprintf(&dstsock->sin6_addr),
+		       ip6_sprintf(ip6buf, &dstsock->sin6_addr),
 		       dstsock->sin6_scope_id); /* for debug */
 	}
 #endif
diff --git a/sys/netinet6/in6_var.h b/sys/netinet6/in6_var.h
index 98fd03deba9e..a456eff01dbc 100644
--- a/sys/netinet6/in6_var.h
+++ b/sys/netinet6/in6_var.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: in6_var.h,v 1.89 2017/01/10 05:42:34 ozaki-r Exp $	*/
+/*	$NetBSD: in6_var.h,v 1.90 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: in6_var.h,v 1.81 2002/06/08 11:16:51 itojun Exp $	*/
 
 /*
@@ -806,7 +806,7 @@ struct in6_ifaddr *
 	in6ifa_ifpwithaddr_psref(const struct ifnet *, const struct in6_addr *,
 	    struct psref *);
 struct in6_ifaddr *in6ifa_ifwithaddr(const struct in6_addr *, uint32_t);
-char	*ip6_sprintf(const struct in6_addr *);
+char	*ip6_sprintf(char *, const struct in6_addr *);
 int	in6_matchlen(struct in6_addr *, struct in6_addr *);
 int	in6_are_prefix_equal(struct in6_addr *, struct in6_addr *, int);
 void	in6_prefixlen2mask(struct in6_addr *, int);
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c
index 01d4f51fb7c8..869c28a07d1e 100644
--- a/sys/netinet6/ip6_forward.c
+++ b/sys/netinet6/ip6_forward.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_forward.c,v 1.83 2017/01/11 13:08:29 ozaki-r Exp $	*/
+/*	$NetBSD: ip6_forward.c,v 1.84 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: ip6_forward.c,v 1.109 2002/09/11 08:10:17 sakane Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_forward.c,v 1.83 2017/01/11 13:08:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_forward.c,v 1.84 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_gateway.h"
@@ -368,10 +368,13 @@ ip6_forward(struct mbuf *m, int srcrt)
 		if ((rt->rt_flags & (RTF_BLACKHOLE|RTF_REJECT)) == 0)
 #endif
 		{
+			char ip6bufs[INET6_ADDRSTRLEN];
+			char ip6bufd[INET6_ADDRSTRLEN];
+
 			printf("ip6_forward: outgoing interface is loopback. "
 			       "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
-			       ip6_sprintf(&ip6->ip6_src),
-			       ip6_sprintf(&ip6->ip6_dst),
+			       ip6_sprintf(ip6bufs, &ip6->ip6_src),
+			       ip6_sprintf(ip6bufd, &ip6->ip6_dst),
 			       ip6->ip6_nxt, if_name(rcvif),
 			       if_name(rt->rt_ifp));
 		}
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 3b2aba55c238..cb03bec044ab 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_input.c,v 1.171 2016/12/08 05:16:34 ozaki-r Exp $	*/
+/*	$NetBSD: ip6_input.c,v 1.172 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.171 2016/12/08 05:16:34 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.172 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_gateway.h"
@@ -528,9 +528,11 @@ ip6_input(struct mbuf *m, struct ifnet *rcvif)
 			goto hbhcheck;
 		} else {
 			/* address is not ready, so discard the packet. */
+			char ip6bufs[INET6_ADDRSTRLEN];
+			char ip6bufd[INET6_ADDRSTRLEN];
 			nd6log(LOG_INFO, "packet to an unready address %s->%s\n",
-			    ip6_sprintf(&ip6->ip6_src),
-			    ip6_sprintf(&ip6->ip6_dst));
+			    ip6_sprintf(ip6bufs, &ip6->ip6_src),
+			    ip6_sprintf(ip6bufd, &ip6->ip6_dst));
 
 			goto bad_unref;
 		}
diff --git a/sys/netinet6/ip6_mroute.c b/sys/netinet6/ip6_mroute.c
index c91272661bbf..4854c39e2926 100644
--- a/sys/netinet6/ip6_mroute.c
+++ b/sys/netinet6/ip6_mroute.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_mroute.c,v 1.113 2017/01/11 13:08:29 ozaki-r Exp $	*/
+/*	$NetBSD: ip6_mroute.c,v 1.114 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: ip6_mroute.c,v 1.49 2001/07/25 09:21:18 jinmei Exp $	*/
 
 /*
@@ -117,7 +117,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_mroute.c,v 1.113 2017/01/11 13:08:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_mroute.c,v 1.114 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -790,6 +790,7 @@ add_m6fc(struct mf6cctl *mfccp)
 	struct rtdetq *rte;
 	u_short nstl;
 	int s;
+	char ip6bufo[INET6_ADDRSTRLEN], ip6bufm[INET6_ADDRSTRLEN];
 
 	MF6CFIND(mfccp->mf6cc_origin.sin6_addr,
 		 mfccp->mf6cc_mcastgrp.sin6_addr, rt);
@@ -799,8 +800,10 @@ add_m6fc(struct mf6cctl *mfccp)
 #ifdef MRT6DEBUG
 		if (mrt6debug & DEBUG_MFC)
 			log(LOG_DEBUG,"add_m6fc update o %s g %s p %x\n",
-			    ip6_sprintf(&mfccp->mf6cc_origin.sin6_addr),
-			    ip6_sprintf(&mfccp->mf6cc_mcastgrp.sin6_addr),
+			    ip6_sprintf(ip6bufo,
+			    &mfccp->mf6cc_origin.sin6_addr),
+			    ip6_sprintf(ip6bufm,
+			    &mfccp->mf6cc_mcastgrp.sin6_addr),
 			    mfccp->mf6cc_parent);
 #endif
 
@@ -828,16 +831,20 @@ add_m6fc(struct mf6cctl *mfccp)
 				log(LOG_ERR,
 				    "add_m6fc: %s o %s g %s p %x dbx %p\n",
 				    "multiple kernel entries",
-				    ip6_sprintf(&mfccp->mf6cc_origin.sin6_addr),
-				    ip6_sprintf(&mfccp->mf6cc_mcastgrp.sin6_addr),
+				    ip6_sprintf(ip6bufo,
+				    &mfccp->mf6cc_origin.sin6_addr),
+				    ip6_sprintf(ip6bufm,
+				    &mfccp->mf6cc_mcastgrp.sin6_addr),
 				    mfccp->mf6cc_parent, rt->mf6c_stall);
 
 #ifdef MRT6DEBUG
 			if (mrt6debug & DEBUG_MFC)
 				log(LOG_DEBUG,
 				    "add_m6fc o %s g %s p %x dbg %p\n",
-				    ip6_sprintf(&mfccp->mf6cc_origin.sin6_addr),
-				    ip6_sprintf(&mfccp->mf6cc_mcastgrp.sin6_addr),
+				    ip6_sprintf(ip6bufo,
+				    &mfccp->mf6cc_origin.sin6_addr),
+				    ip6_sprintf(ip6bufm,
+				    &mfccp->mf6cc_mcastgrp.sin6_addr),
 				    mfccp->mf6cc_parent, rt->mf6c_stall);
 #endif
 
@@ -879,8 +886,10 @@ add_m6fc(struct mf6cctl *mfccp)
 			log(LOG_DEBUG,
 			    "add_mfc no upcall h %ld o %s g %s p %x\n",
 			    hash,
-			    ip6_sprintf(&mfccp->mf6cc_origin.sin6_addr),
-			    ip6_sprintf(&mfccp->mf6cc_mcastgrp.sin6_addr),
+			    ip6_sprintf(ip6bufo,
+			    &mfccp->mf6cc_origin.sin6_addr),
+			    ip6_sprintf(ip6bufm,
+			    &mfccp->mf6cc_mcastgrp.sin6_addr),
 			    mfccp->mf6cc_parent);
 #endif
 
@@ -979,10 +988,12 @@ del_m6fc(struct mf6cctl *mfccp)
 	hash = MF6CHASH(origin.sin6_addr, mcastgrp.sin6_addr);
 
 #ifdef MRT6DEBUG
-	if (mrt6debug & DEBUG_MFC)
+	if (mrt6debug & DEBUG_MFC) {
+		char ip6bufo[INET6_ADDRSTRLEN], ip6bufm[INET6_ADDRSTRLEN];
 		log(LOG_DEBUG,"del_m6fc orig %s mcastgrp %s\n",
-		    ip6_sprintf(&origin.sin6_addr),
-		    ip6_sprintf(&mcastgrp.sin6_addr));
+		    ip6_sprintf(ip6bufo, &origin.sin6_addr),
+		    ip6_sprintf(ip6bufm, &mcastgrp.sin6_addr));
+	}
 #endif
 
 	s = splsoftnet();
@@ -1044,11 +1055,13 @@ ip6_mforward(struct ip6_hdr *ip6, struct ifnet *ifp, struct mbuf *m)
 	int s;
 	mifi_t mifi;
 	struct sockaddr_in6 sin6;
+	char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
 
 #ifdef MRT6DEBUG
 	if (mrt6debug & DEBUG_FORWARD)
 		log(LOG_DEBUG, "ip6_mforward: src %s, dst %s, ifindex %d\n",
-		    ip6_sprintf(&ip6->ip6_src), ip6_sprintf(&ip6->ip6_dst),
+		    ip6_sprintf(ip6bufs, &ip6->ip6_src),
+		    ip6_sprintf(ip6bufd, &ip6->ip6_dst),
 		    ifp->if_index);
 #endif
 
@@ -1075,8 +1088,8 @@ ip6_mforward(struct ip6_hdr *ip6, struct ifnet *ifp, struct mbuf *m)
 			log(LOG_DEBUG,
 			    "cannot forward "
 			    "from %s to %s nxt %d received on %s\n",
-			    ip6_sprintf(&ip6->ip6_src),
-			    ip6_sprintf(&ip6->ip6_dst),
+			    ip6_sprintf(ip6bufs, &ip6->ip6_src),
+			    ip6_sprintf(ip6bufd, &ip6->ip6_dst),
 			    ip6->ip6_nxt,
 			    m->m_pkthdr.rcvif_index ?
 			    if_name(m_get_rcvif_NOMPSAFE(m)) : "?");
@@ -1115,8 +1128,8 @@ ip6_mforward(struct ip6_hdr *ip6, struct ifnet *ifp, struct mbuf *m)
 #ifdef MRT6DEBUG
 		if (mrt6debug & (DEBUG_FORWARD | DEBUG_MFC))
 			log(LOG_DEBUG, "ip6_mforward: no rte s %s g %s\n",
-			    ip6_sprintf(&ip6->ip6_src),
-			    ip6_sprintf(&ip6->ip6_dst));
+			    ip6_sprintf(ip6bufs, &ip6->ip6_src),
+			    ip6_sprintf(ip6bufd, &ip6->ip6_dst));
 #endif
 
 		/*
@@ -1315,10 +1328,16 @@ expire_upcalls(void *unused)
 			    mfc->mf6c_expire != 0 &&
 			    --mfc->mf6c_expire == 0) {
 #ifdef MRT6DEBUG
-				if (mrt6debug & DEBUG_EXPIRE)
-					log(LOG_DEBUG, "expire_upcalls: expiring (%s %s)\n",
-					    ip6_sprintf(&mfc->mf6c_origin.sin6_addr),
-					    ip6_sprintf(&mfc->mf6c_mcastgrp.sin6_addr));
+				if (mrt6debug & DEBUG_EXPIRE) {
+					char ip6bufo[INET6_ADDRSTRLEN];
+					char ip6bufm[INET6_ADDRSTRLEN];
+					log(LOG_DEBUG,
+					    "expire_upcalls: expiring (%s %s)\n",
+					    ip6_sprintf(ip6bufo,
+					    &mfc->mf6c_origin.sin6_addr),
+					    ip6_sprintf(ip6bufm,
+					    &mfc->mf6c_mcastgrp.sin6_addr));
+				}
 #endif
 				/*
 				 * drop all the packets
@@ -1621,14 +1640,17 @@ phyint_send(struct ip6_hdr *ip6, struct mif6 *mifp, struct mbuf *m)
 			icmp6_error(mb_copy, ICMP6_PACKET_TOO_BIG, 0, linkmtu);
 		else {
 #ifdef MRT6DEBUG
-			if (mrt6debug & DEBUG_XMIT)
+			if (mrt6debug & DEBUG_XMIT) {
+				char ip6bufs[INET6_ADDRSTRLEN];
+				char ip6bufd[INET6_ADDRSTRLEN];
 				log(LOG_DEBUG,
 				    "phyint_send: packet too big on %s o %s g %s"
 				    " size %d(discarded)\n",
 				    if_name(ifp),
-				    ip6_sprintf(&ip6->ip6_src),
-				    ip6_sprintf(&ip6->ip6_dst),
+				    ip6_sprintf(ip6bufs, &ip6->ip6_src),
+				    ip6_sprintf(ip6bufd, &ip6->ip6_dst),
 				    mb_copy->m_pkthdr.len);
+			}
 #endif /* MRT6DEBUG */
 			m_freem(mb_copy); /* simply discard the packet */
 		}
@@ -1646,9 +1668,12 @@ register_send(struct ip6_hdr *ip6, struct mif6 *mif, struct mbuf *m)
 	struct mrt6msg *im6;
 
 #ifdef MRT6DEBUG
-	if (mrt6debug)
+	if (mrt6debug) {
+		char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
 		log(LOG_DEBUG, "** IPv6 register_send **\n src %s dst %s\n",
-		    ip6_sprintf(&ip6->ip6_src), ip6_sprintf(&ip6->ip6_dst));
+		    ip6_sprintf(ip6bufs, &ip6->ip6_src),
+		    ip6_sprintf(ip6bufd, &ip6->ip6_dst));
+	}
 #endif
 	PIM6_STATINC(PIM6_STAT_SND_REGISTERS);
 
@@ -1829,27 +1854,31 @@ pim6_input(struct mbuf **mp, int *offp, int proto)
 		 * Validate length
 		 */
 		if (pimlen < PIM6_REG_MINLEN) {
-			PIM6_STATINC(PIM6_STAT_RCV_TOOSHORT);
-			PIM6_STATINC(PIM6_STAT_RCV_BADREGISTERS);
 #ifdef MRT6DEBUG
+			char ip6buf[INET6_ADDRSTRLEN];
 			log(LOG_ERR,
 			    "pim6_input: register packet size too "
 			    "small %d from %s\n",
-			    pimlen, ip6_sprintf(&ip6->ip6_src));
+			    pimlen, ip6_sprintf(ip6buf, &ip6->ip6_src));
 #endif
+			PIM6_STATINC(PIM6_STAT_RCV_TOOSHORT);
+			PIM6_STATINC(PIM6_STAT_RCV_BADREGISTERS);
 			m_freem(m);
 			return (IPPROTO_DONE);
 		}
 
 		eip6 = (struct ip6_hdr *) (reghdr + 1);
 #ifdef MRT6DEBUG
-		if (mrt6debug & DEBUG_PIM)
+		if (mrt6debug & DEBUG_PIM) {
+			char ip6bufs[INET6_ADDRSTRLEN];
+			char ip6bufd[INET6_ADDRSTRLEN];
 			log(LOG_DEBUG,
 			    "pim6_input[register], eip6: %s -> %s, "
 			    "eip6 plen %d\n",
-			    ip6_sprintf(&eip6->ip6_src),
-			    ip6_sprintf(&eip6->ip6_dst),
+			    ip6_sprintf(ip6bufs, &eip6->ip6_src),
+			    ip6_sprintf(ip6bufd, &eip6->ip6_dst),
 			    ntohs(eip6->ip6_plen));
+		}
 #endif
 
 		/* verify the version number of the inner packet */
@@ -1868,11 +1897,13 @@ pim6_input(struct mbuf **mp, int *offp, int proto)
 		if (!IN6_IS_ADDR_MULTICAST(&eip6->ip6_dst)) {
 			PIM6_STATINC(PIM6_STAT_RCV_BADREGISTERS);
 #ifdef MRT6DEBUG
-			if (mrt6debug & DEBUG_PIM)
+			if (mrt6debug & DEBUG_PIM) {
+				char ip6buf[INET6_ADDRSTRLEN];
 				log(LOG_DEBUG,
 				    "pim6_input: inner packet of register "
 				    "is not multicast %s\n",
-				    ip6_sprintf(&eip6->ip6_dst));
+				    ip6_sprintf(ip6buf, &eip6->ip6_dst));
+			}
 #endif
 			m_freem(m);
 			return (IPPROTO_DONE);
@@ -1898,11 +1929,13 @@ pim6_input(struct mbuf **mp, int *offp, int proto)
 		m_adj(m, off + PIM_MINLEN);
 #ifdef MRT6DEBUG
 		if (mrt6debug & DEBUG_PIM) {
+			char ip6bufs[INET6_ADDRSTRLEN];
+			char ip6bufd[INET6_ADDRSTRLEN];
 			log(LOG_DEBUG,
 			    "pim6_input: forwarding decapsulated register: "
 			    "src %s, dst %s, mif %d\n",
-			    ip6_sprintf(&eip6->ip6_src),
-			    ip6_sprintf(&eip6->ip6_dst),
+			    ip6_sprintf(ip6bufs, &eip6->ip6_src),
+			    ip6_sprintf(ip6bufd, &eip6->ip6_dst),
 			    reg_mif_num);
 		}
 #endif
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 39273509179e..0037153edcd5 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_output.c,v 1.180 2017/01/11 13:08:29 ozaki-r Exp $	*/
+/*	$NetBSD: ip6_output.c,v 1.181 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.180 2017/01/11 13:08:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.181 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -581,9 +581,10 @@ ip6_output(
 
 	/* Ensure we only send from a valid address. */
 	if ((error = ip6_ifaddrvalid(&src0)) != 0) {
+		char ip6buf[INET6_ADDRSTRLEN];
 		nd6log(LOG_ERR,
 		    "refusing to send from invalid address %s (pid %d)\n",
-		    ip6_sprintf(&src0), curproc->p_pid);
+		    ip6_sprintf(ip6buf, &src0), curproc->p_pid);
 		IP6_STATINC(IP6_STAT_ODROPPED);
 		in6_ifstat_inc(origifp, ifs6_out_discard);
 		if (error == 1)
diff --git a/sys/netinet6/mld6.c b/sys/netinet6/mld6.c
index 2eda7262ed9a..1f49d206c89a 100644
--- a/sys/netinet6/mld6.c
+++ b/sys/netinet6/mld6.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mld6.c,v 1.77 2017/01/11 13:08:29 ozaki-r Exp $	*/
+/*	$NetBSD: mld6.c,v 1.78 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: mld6.c,v 1.25 2001/01/16 14:14:18 itojun Exp $	*/
 
 /*
@@ -102,7 +102,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.77 2017/01/11 13:08:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.78 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -373,9 +373,12 @@ mld_input(struct mbuf *m, int off)
 		 * though RFC3590 says "SHOULD log" if the source of a query
 		 * is the unspecified address.
 		 */
+		char ip6bufs[INET6_ADDRSTRLEN];
+		char ip6bufm[INET6_ADDRSTRLEN];
 		log(LOG_INFO,
 		    "mld_input: src %s is not link-local (grp=%s)\n",
-		    ip6_sprintf(&ip6->ip6_src), ip6_sprintf(&mldh->mld_addr));
+		    ip6_sprintf(ip6bufs,&ip6->ip6_src),
+		    ip6_sprintf(ip6bufm, &mldh->mld_addr));
 #endif
 		goto out;
 	}
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index 1326eff69115..1ab59575eaea 100644
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nd6.c,v 1.224 2017/01/11 13:08:29 ozaki-r Exp $	*/
+/*	$NetBSD: nd6.c,v 1.225 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.224 2017/01/11 13:08:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.225 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_net_mpsafe.h"
@@ -920,18 +920,19 @@ nd6_assert_purged(struct ifnet *ifp)
 {
 	struct nd_defrouter *dr;
 	struct nd_prefix *pr;
+	char ip6buf[INET6_ADDRSTRLEN] __diagused;
 
 	ND6_RLOCK();
 	ND_DEFROUTER_LIST_FOREACH(dr) {
 		KASSERTMSG(dr->ifp != ifp,
 		    "defrouter %s remains on %s",
-		    ip6_sprintf(&dr->rtaddr), ifp->if_xname);
+		    ip6_sprintf(ip6buf, &dr->rtaddr), ifp->if_xname);
 	}
 
 	ND_PREFIX_LIST_FOREACH(pr) {
 		KASSERTMSG(pr->ndpr_ifp != ifp,
 		    "prefix %s/%d remains on %s",
-		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr),
 		    pr->ndpr_plen, ifp->if_xname);
 	}
 	ND6_UNLOCK();
@@ -1590,9 +1591,10 @@ nd6_rtrequest(int req, struct rtentry *rt, const struct rt_addrinfo *info)
 				if (in6_setscope(&llsol, ifp, NULL))
 					goto out;
 				if (!in6_addmulti(&llsol, ifp, &error, 0)) {
+					char ip6buf[INET6_ADDRSTRLEN];
 					nd6log(LOG_ERR, "%s: failed to join "
 					    "%s (errno=%d)\n", if_name(ifp),
-					    ip6_sprintf(&llsol), error);
+					    ip6_sprintf(ip6buf, &llsol), error);
 				}
 			}
 		}
@@ -2341,10 +2343,11 @@ nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m,
 	if (ln == NULL) {
 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
 		    !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
+			char ip6buf[INET6_ADDRSTRLEN];
 			log(LOG_DEBUG,
 			    "nd6_output: can't allocate llinfo for %s "
 			    "(ln=%p, rt=%p)\n",
-			    ip6_sprintf(&dst->sin6_addr), ln, rt);
+			    ip6_sprintf(ip6buf, &dst->sin6_addr), ln, rt);
 			senderr(EIO);	/* XXX: good error? */
 		}
 		goto sendpkt;	/* send anyway */
@@ -2690,9 +2693,10 @@ fill_drlist(void *oldp, size_t *oldlenp, size_t ol)
 			memset(d, 0, sizeof(*d));
 			sockaddr_in6_init(&d->rtaddr, &dr->rtaddr, 0, 0, 0);
 			if (sa6_recoverscope(&d->rtaddr)) {
+				char ip6buf[INET6_ADDRSTRLEN];
 				log(LOG_ERR,
 				    "scope error in router list (%s)\n",
-				    ip6_sprintf(&d->rtaddr.sin6_addr));
+				    ip6_sprintf(ip6buf, &d->rtaddr.sin6_addr));
 				/* XXX: press on... */
 			}
 			d->flags = dr->flags;
@@ -2726,6 +2730,7 @@ fill_prlist(void *oldp, size_t *oldlenp, size_t ol)
 	uint8_t *p = NULL, *ps = NULL;
 	uint8_t *pe = NULL;
 	size_t l;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	if (oldp) {
 		ps = p = (uint8_t*)oldp;
@@ -2749,7 +2754,7 @@ fill_prlist(void *oldp, size_t *oldlenp, size_t ol)
 			if (sa6_recoverscope(&pfx.prefix)) {
 				log(LOG_ERR,
 				    "scope error in prefix list (%s)\n",
-				    ip6_sprintf(&pfx.prefix.sin6_addr));
+				    ip6_sprintf(ip6buf, &pfx.prefix.sin6_addr));
 				/* XXX: press on... */
 			}
 			pfx.raflags = pr->ndpr_raf;
@@ -2787,12 +2792,13 @@ fill_prlist(void *oldp, size_t *oldlenp, size_t ol)
 				}
 
 				sockaddr_in6_init(&sin6, &pfr->router->rtaddr,
-				    0, 0, 0);
+					    0, 0, 0);
 				if (sa6_recoverscope(&sin6)) {
 					log(LOG_ERR,
 					    "scope error in "
 					    "prefix list (%s)\n",
-					    ip6_sprintf(&pfr->router->rtaddr));
+					    ip6_sprintf(ip6buf,
+					    &pfr->router->rtaddr));
 				}
 				advrtrs++;
 				memcpy(p, &sin6, sizeof(sin6));
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
index 48f1ed84e851..f50d957b86a4 100644
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nd6_nbr.c,v 1.134 2016/12/19 07:51:34 ozaki-r Exp $	*/
+/*	$NetBSD: nd6_nbr.c,v 1.135 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.134 2016/12/19 07:51:34 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.135 2017/01/16 07:33:36 ryo Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -115,6 +115,7 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 	const struct sockaddr_dl *proxydl = NULL;
 	struct psref psref;
 	struct psref psref_ia;
+	char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN];
 
 	ifp = m_get_rcvif_psref(m, &psref);
 	if (ifp == NULL)
@@ -133,8 +134,8 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 
 	if (ip6->ip6_hlim != 255) {
 		nd6log(LOG_ERR, "invalid hlim (%d) from %s to %s on %s\n",
-		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
-		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp));
+		    ip6->ip6_hlim, ip6_sprintf(ip6buf, &ip6->ip6_src),
+		    ip6_sprintf(ip6buf2, &ip6->ip6_dst), if_name(ifp));
 		goto bad;
 	}
 
@@ -160,7 +161,7 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 		if (nd6_is_addr_neighbor(&ssin6, ifp) == 0) {
 			nd6log(LOG_INFO,
 			    "NS packet from non-neighbor %s on %s\n",
-			    ip6_sprintf(&saddr6), if_name(ifp));
+			    ip6_sprintf(ip6buf, &saddr6), if_name(ifp));
 			goto bad;
 		}
 	}
@@ -276,13 +277,14 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
 		    "(if %d, NS packet %d)\n",
-		    ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2);
+		    ip6_sprintf(ip6buf, &taddr6),
+		    ifp->if_addrlen, lladdrlen - 2);
 		goto bad;
 	}
 
 	if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
 		nd6log(LOG_INFO, "duplicate IP6 address %s\n",
-		    ip6_sprintf(&saddr6));
+		    ip6_sprintf(ip6buf, &saddr6));
 		goto freeit;
 	}
 
@@ -350,9 +352,9 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 	return;
 
  bad:
-	nd6log(LOG_ERR, "src=%s\n", ip6_sprintf(&saddr6));
-	nd6log(LOG_ERR, "dst=%s\n", ip6_sprintf(&daddr6));
-	nd6log(LOG_ERR, "tgt=%s\n", ip6_sprintf(&taddr6));
+	nd6log(LOG_ERR, "src=%s\n", ip6_sprintf(ip6buf, &saddr6));
+	nd6log(LOG_ERR, "dst=%s\n", ip6_sprintf(ip6buf, &daddr6));
+	nd6log(LOG_ERR, "tgt=%s\n", ip6_sprintf(ip6buf, &taddr6));
 	ICMP6_STATINC(ICMP6_STAT_BADNS);
 	ifa_release(ifa, &psref_ia);
 	m_put_rcvif_psref(ifp, &psref);
@@ -473,9 +475,11 @@ nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
 			error = in6_selectsrc(&dst_sa, NULL,
 			    NULL, &ro, NULL, NULL, NULL, &src_in);
 			if (error != 0) {
+				char ip6buf[INET6_ADDRSTRLEN];
 				nd6log(LOG_DEBUG, "source can't be "
 				    "determined: dst=%s, error=%d\n",
-				    ip6_sprintf(&dst_sa.sin6_addr), error);
+				    ip6_sprintf(ip6buf, &dst_sa.sin6_addr),
+				    error);
 				pserialize_read_exit(s);
 				goto bad;
 			}
@@ -580,6 +584,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 	bool checklink = false;
 	struct psref psref;
 	struct psref psref_ia;
+	char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN];
 
 	ifp = m_get_rcvif_psref(m, &psref);
 	if (ifp == NULL)
@@ -588,8 +593,8 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 	if (ip6->ip6_hlim != 255) {
 		nd6log(LOG_ERR,
 		    "invalid hlim (%d) from %s to %s on %s\n",
-		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
-		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp));
+		    ip6->ip6_hlim, ip6_sprintf(ip6buf, &ip6->ip6_src),
+		    ip6_sprintf(ip6buf2, &ip6->ip6_dst), if_name(ifp));
 		goto bad;
 	}
 
@@ -613,7 +618,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 
 	if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
 		nd6log(LOG_ERR, "invalid target address %s\n",
-		    ip6_sprintf(&taddr6));
+		    ip6_sprintf(ip6buf, &taddr6));
 		goto bad;
 	}
 	if (is_solicited && IN6_IS_ADDR_MULTICAST(&daddr6)) {
@@ -657,7 +662,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 	if (ifa) {
 		log(LOG_ERR,
 		    "nd6_na_input: duplicate IP6 address %s\n",
-		    ip6_sprintf(&taddr6));
+		    ip6_sprintf(ip6buf, &taddr6));
 		ifa_release(ifa, &psref_ia);
 		ifa = NULL;
 		goto freeit;
@@ -669,13 +674,13 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 	sockaddr_in6_init(&ssin6, &saddr6, 0, 0, 0);
 	if (nd6_is_addr_neighbor(&ssin6, ifp) == 0) {
 		nd6log(LOG_INFO, "ND packet from non-neighbor %s on %s\n",
-		    ip6_sprintf(&saddr6), if_name(ifp));
+		    ip6_sprintf(ip6buf, &saddr6), if_name(ifp));
 		goto bad;
 	}
 
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
-		    "(if %d, NA packet %d)\n", ip6_sprintf(&taddr6),
+		    "(if %d, NA packet %d)\n", ip6_sprintf(ip6buf, &taddr6),
 		    ifp->if_addrlen, lladdrlen - 2);
 		goto bad;
 	}
@@ -968,9 +973,10 @@ nd6_na_output(
 	error = in6_selectsrc(satosin6(dst), NULL, NULL, &ro, NULL, NULL, NULL,
 	    &ip6->ip6_src);
 	if (error != 0) {
+		char ip6buf[INET6_ADDRSTRLEN];
 		nd6log(LOG_DEBUG, "source can't be "
 		    "determined: dst=%s, error=%d\n",
-		    ip6_sprintf(&satocsin6(dst)->sin6_addr), error);
+		    ip6_sprintf(ip6buf, &satocsin6(dst)->sin6_addr), error);
 		goto bad;
 	}
 	nd_na = (struct nd_neighbor_advert *)(ip6 + 1);
@@ -1117,6 +1123,7 @@ nd6_dad_start(struct ifaddr *ifa, int xtick)
 {
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 	struct dadq *dp;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	if (!dad_init) {
 		TAILQ_INIT(&dadq);
@@ -1134,7 +1141,7 @@ nd6_dad_start(struct ifaddr *ifa, int xtick)
 		log(LOG_DEBUG,
 			"nd6_dad_start: called with non-tentative address "
 			"%s(%s)\n",
-			ip6_sprintf(&ia->ia_addr.sin6_addr),
+			ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
 	}
@@ -1159,7 +1166,7 @@ nd6_dad_start(struct ifaddr *ifa, int xtick)
 		mutex_exit(&nd6_dad_lock);
 		log(LOG_ERR, "nd6_dad_start: memory allocation failed for "
 			"%s(%s)\n",
-			ip6_sprintf(&ia->ia_addr.sin6_addr),
+			ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		return;
 	}
@@ -1180,7 +1187,7 @@ nd6_dad_start(struct ifaddr *ifa, int xtick)
 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
 
 	nd6log(LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
-	    ip6_sprintf(&ia->ia_addr.sin6_addr));
+	    ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr));
 
 	if (xtick == 0) {
 		nd6_dad_ns_output(dp, ifa);
@@ -1227,6 +1234,7 @@ nd6_dad_timer(struct ifaddr *ifa)
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 	struct dadq *dp;
 	int duplicate = 0;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 #ifndef NET_MPSAFE
 	mutex_enter(softnet_lock);
@@ -1247,14 +1255,14 @@ nd6_dad_timer(struct ifaddr *ifa)
 	if (ia->ia6_flags & IN6_IFF_DUPLICATED) {
 		log(LOG_ERR, "nd6_dad_timer: called with duplicate address "
 			"%s(%s)\n",
-			ip6_sprintf(&ia->ia_addr.sin6_addr),
+			ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		goto done;
 	}
 	if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) {
 		log(LOG_ERR, "nd6_dad_timer: called with non-tentative address "
 			"%s(%s)\n",
-			ip6_sprintf(&ia->ia_addr.sin6_addr),
+			ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
 		goto done;
 	}
@@ -1311,7 +1319,7 @@ nd6_dad_timer(struct ifaddr *ifa)
 			nd6log(LOG_DEBUG,
 			    "%s: DAD complete for %s - no duplicates found\n",
 			    if_name(ifa->ifa_ifp),
-			    ip6_sprintf(&ia->ia_addr.sin6_addr));
+			    ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr));
 
 			TAILQ_REMOVE(&dadq, dp, dad_list);
 			free(dp, M_IP6NDP);
@@ -1338,6 +1346,7 @@ nd6_dad_duplicated(struct ifaddr *ifa)
 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 	struct ifnet *ifp;
 	struct dadq *dp;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	mutex_enter(&nd6_dad_lock);
 	dp = nd6_dad_find(ifa);
@@ -1350,7 +1359,7 @@ nd6_dad_duplicated(struct ifaddr *ifa)
 	ifp = ifa->ifa_ifp;
 	log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: "
 	    "NS in/out=%d/%d, NA in=%d\n",
-	    if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr),
+	    if_name(ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
 	    dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount);
 
 	ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
@@ -1360,7 +1369,7 @@ nd6_dad_duplicated(struct ifaddr *ifa)
 	nd6_dad_stoptimer(dp);
 
 	log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
-	    if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr));
+	    if_name(ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr));
 	log(LOG_ERR, "%s: manual intervention required\n",
 	    if_name(ifp));
 
@@ -1454,8 +1463,9 @@ nd6_dad_ns_input(struct ifaddr *ifa)
 
 	/* Quickhack - completely ignore DAD NS packets */
 	if (dad_ignore_ns) {
+		char ip6buf[INET6_ADDRSTRLEN];
 		nd6log(LOG_INFO, "ignoring DAD NS packet for "
-		    "address %s(%s)\n", ip6_sprintf(taddr6),
+		    "address %s(%s)\n", ip6_sprintf(ip6buf, taddr6),
 		    if_name(ifa->ifa_ifp));
 		return;
 	}
diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
index b106a878d248..b63d313ccbb3 100644
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nd6_rtr.c,v 1.129 2017/01/04 19:37:14 christos Exp $	*/
+/*	$NetBSD: nd6_rtr.c,v 1.130 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME: nd6_rtr.c,v 1.95 2001/02/07 08:09:47 itojun Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6_rtr.c,v 1.129 2017/01/04 19:37:14 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6_rtr.c,v 1.130 2017/01/16 07:33:36 ryo Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -145,6 +145,7 @@ nd6_rs_input(struct mbuf *m, int off, int icmp6len)
 	int lladdrlen = 0;
 	union nd_opts ndopts;
 	struct psref psref;
+	char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
 
 	ifp = m_get_rcvif_psref(m, &psref);
 	if (ifp == NULL)
@@ -159,8 +160,8 @@ nd6_rs_input(struct mbuf *m, int off, int icmp6len)
 	/* Sanity checks */
 	if (ip6->ip6_hlim != 255) {
 		nd6log(LOG_ERR, "invalid hlim (%d) from %s to %s on %s\n",
-		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
-		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp));
+		    ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src),
+		    ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp));
 		goto bad;
 	}
 
@@ -193,7 +194,8 @@ nd6_rs_input(struct mbuf *m, int off, int icmp6len)
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
 		    "(if %d, RS packet %d)\n",
-		    ip6_sprintf(&saddr6), ifp->if_addrlen, lladdrlen - 2);
+		    ip6_sprintf(ip6bufs, &saddr6),
+		    ifp->if_addrlen, lladdrlen - 2);
 		goto bad;
 	}
 
@@ -235,6 +237,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 	union nd_opts ndopts;
 	struct nd_defrouter *dr;
 	struct psref psref;
+	char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN];
 
 	ifp = m_get_rcvif_psref(m, &psref);
 	if (ifp == NULL)
@@ -251,14 +254,14 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 
 	if (ip6->ip6_hlim != 255) {
 		nd6log(LOG_ERR, "invalid hlim (%d) from %s to %s on %s\n",
-		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
-		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp));
+		    ip6->ip6_hlim, ip6_sprintf(ip6buf, &ip6->ip6_src),
+		    ip6_sprintf(ip6buf2, &ip6->ip6_dst), if_name(ifp));
 		goto bad;
 	}
 
 	if (!IN6_IS_ADDR_LINKLOCAL(&saddr6)) {
 		nd6log(LOG_ERR, "src %s is not link-local\n",
-		    ip6_sprintf(&saddr6));
+		    ip6_sprintf(ip6buf, &saddr6));
 		goto bad;
 	}
 
@@ -309,7 +312,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 		else if (ndi->chlim != nd_ra->nd_ra_curhoplimit)
 			log(LOG_ERR, "nd_ra_input: lower CurHopLimit sent from "
 			   "%s on %s (current=%d, received=%d), ignored\n",
-			   ip6_sprintf(&ip6->ip6_src),
+			   ip6_sprintf(ip6buf, &ip6->ip6_src),
 			   if_name(ifp), ndi->chlim, nd_ra->nd_ra_curhoplimit);
 	}
 	ND6_WLOCK();
@@ -350,7 +353,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 			 || IN6_IS_ADDR_LINKLOCAL(&pi->nd_opt_pi_prefix)) {
 				nd6log(LOG_INFO,
 				    "invalid prefix %s, ignored\n",
-				    ip6_sprintf(&pi->nd_opt_pi_prefix));
+				    ip6_sprintf(ip6buf, &pi->nd_opt_pi_prefix));
 				continue;
 			}
 
@@ -385,7 +388,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 		if (mtu < IPV6_MMTU) {
 			nd6log(LOG_INFO, "bogus mtu option "
 			    "mtu=%lu sent from %s, ignoring\n",
-			    mtu, ip6_sprintf(&ip6->ip6_src));
+			    mtu, ip6_sprintf(ip6buf, &ip6->ip6_src));
 			goto skip;
 		}
 
@@ -402,7 +405,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 			nd6log(LOG_INFO,
 			    "bogus mtu mtu=%lu sent from %s; "
 			    "exceeds maxmtu %lu, ignoring\n",
-			    mtu, ip6_sprintf(&ip6->ip6_src), maxmtu);
+			    mtu, ip6_sprintf(ip6buf, &ip6->ip6_src), maxmtu);
 		}
 	}
 
@@ -422,7 +425,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 
 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
-		    "(if %d, RA packet %d)\n", ip6_sprintf(&saddr6),
+		    "(if %d, RA packet %d)\n", ip6_sprintf(ip6buf, &saddr6),
 		    ifp->if_addrlen, lladdrlen - 2);
 		goto bad;
 	}
@@ -1003,9 +1006,10 @@ nd6_prelist_add(struct nd_prefixctl *prc, struct nd_defrouter *dr,
 		int e;
 
 		if ((e = nd6_prefix_onlink(newpr)) != 0) {
+			char ip6buf[INET6_ADDRSTRLEN];
 			nd6log(LOG_ERR, "failed to make "
 			    "the prefix %s/%d on-link on %s (errno=%d)\n",
-			    ip6_sprintf(&prc->ndprc_prefix.sin6_addr),
+			    ip6_sprintf(ip6buf, &prc->ndprc_prefix.sin6_addr),
 			    prc->ndprc_plen, if_name(prc->ndprc_ifp), e);
 			/* proceed anyway. XXX: is it correct? */
 		}
@@ -1053,9 +1057,10 @@ nd6_prelist_remove(struct nd_prefix *pr)
 #endif
 	if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0 &&
 	    (e = nd6_prefix_offlink(pr)) != 0) {
+		char ip6buf[INET6_ADDRSTRLEN];
 		nd6log(LOG_ERR,
 		    "failed to make %s/%d offlink on %s, errno=%d\n",
-		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr),
 		    pr->ndpr_plen, if_name(pr->ndpr_ifp), e);
 		/* what should we do? */
 	}
@@ -1099,6 +1104,7 @@ prelist_update(struct nd_prefixctl *newprc,
 	int auth;
 	struct in6_addrlifetime lt6_tmp;
 	int ss;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	ND6_ASSERT_WLOCK();
 
@@ -1145,7 +1151,8 @@ prelist_update(struct nd_prefixctl *newprc,
 				    "failed to make "
 				    "the prefix %s/%d on-link on %s "
 				    "(errno=%d)\n",
-				    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+				    ip6_sprintf(ip6buf,
+				    &pr->ndpr_prefix.sin6_addr),
 				    pr->ndpr_plen, if_name(pr->ndpr_ifp), e);
 				/* proceed anyway. XXX: is it correct? */
 			}
@@ -1171,7 +1178,7 @@ prelist_update(struct nd_prefixctl *newprc,
 			nd6log(LOG_NOTICE,
 			    "nd6_prelist_add failed for %s/%d on %s "
 			    "errno=%d, returnpr=%p\n",
-			    ip6_sprintf(&newprc->ndprc_prefix.sin6_addr),
+			    ip6_sprintf(ip6buf, &newprc->ndprc_prefix.sin6_addr),
 			    newprc->ndprc_plen, if_name(newprc->ndprc_ifp),
 			    error, newpr);
 			goto end; /* we should just give up in this case. */
@@ -1472,6 +1479,7 @@ nd6_pfxlist_onlink_check(void)
 	struct nd_defrouter *dr;
 	struct nd_pfxrouter *pfxrtr = NULL;
 	int s;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	ND6_ASSERT_WLOCK();
 
@@ -1564,7 +1572,8 @@ nd6_pfxlist_onlink_check(void)
 			if ((e = nd6_prefix_offlink(pr)) != 0) {
 				nd6log(LOG_ERR,
 				    "failed to make %s/%d offlink, errno=%d\n",
-				    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+				    ip6_sprintf(ip6buf,
+				    &pr->ndpr_prefix.sin6_addr),
 				    pr->ndpr_plen, e);
 			}
 		}
@@ -1574,7 +1583,8 @@ nd6_pfxlist_onlink_check(void)
 			if ((e = nd6_prefix_onlink(pr)) != 0) {
 				nd6log(LOG_ERR,
 				    "failed to make %s/%d onlink, errno=%d\n",
-				    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+				    ip6_sprintf(ip6buf,
+				    &pr->ndpr_prefix.sin6_addr),
 				    pr->ndpr_plen, e);
 			}
 		}
@@ -1689,13 +1699,16 @@ nd6_prefix_onlink(struct nd_prefix *pr)
 	int error = 0;
 	struct psref psref;
 	int bound;
+	char ip6buf[INET6_ADDRSTRLEN];
+	char ip6bufp[INET6_ADDRSTRLEN], ip6bufm[INET6_ADDRSTRLEN];
 
 	ND6_ASSERT_WLOCK();
 
 	/* sanity check */
 	if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0) {
 		nd6log(LOG_ERR, "%s/%d is already on-link\n",
-		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr), pr->ndpr_plen);
+		    ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr),
+		    pr->ndpr_plen);
 		return (EEXIST);
 	}
 
@@ -1746,7 +1759,7 @@ nd6_prefix_onlink(struct nd_prefix *pr)
 		 */
 		nd6log(LOG_NOTICE, "failed to find any ifaddr"
 		    " to add route for a prefix(%s/%d) on %s\n",
-		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr),
 		    pr->ndpr_plen, if_name(ifp));
 		curlwp_bindx(bound);
 		return (0);
@@ -1780,10 +1793,11 @@ nd6_prefix_onlink(struct nd_prefix *pr)
 		nd6log(LOG_ERR, "failed to add route for a"
 		    " prefix (%s/%d) on %s, gw=%s, mask=%s, flags=%lx "
 		    "errno = %d\n",
-		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr),
+		    ip6_sprintf(ip6bufp, &pr->ndpr_prefix.sin6_addr),
 		    pr->ndpr_plen, if_name(ifp),
-		    ip6_sprintf(&((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr),
-		    ip6_sprintf(&mask6.sin6_addr), rtflags, error);
+		    ip6_sprintf(ip6buf,
+		    &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr),
+		    ip6_sprintf(ip6bufm, &mask6.sin6_addr), rtflags, error);
 	}
 	ifa_release(ifa, &psref);
 	curlwp_bindx(bound);
@@ -1798,13 +1812,15 @@ nd6_prefix_offlink(struct nd_prefix *pr)
 	struct ifnet *ifp = pr->ndpr_ifp;
 	struct nd_prefix *opr;
 	struct sockaddr_in6 sa6, mask6;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	ND6_ASSERT_WLOCK();
 
 	/* sanity check */
 	if ((pr->ndpr_stateflags & NDPRF_ONLINK) == 0) {
 		nd6log(LOG_ERR, "%s/%d is already off-link\n",
-		    ip6_sprintf(&pr->ndpr_prefix.sin6_addr), pr->ndpr_plen);
+		    ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr),
+		    pr->ndpr_plen);
 		return (EEXIST);
 	}
 
@@ -1846,7 +1862,8 @@ nd6_prefix_offlink(struct nd_prefix *pr)
 					nd6log(LOG_ERR, "failed to "
 					    "recover a prefix %s/%d from %s "
 					    "to %s (errno = %d)\n",
-					    ip6_sprintf(&opr->ndpr_prefix.sin6_addr),
+					    ip6_sprintf(ip6buf,
+					    &opr->ndpr_prefix.sin6_addr),
 					    opr->ndpr_plen, if_name(ifp),
 					    if_name(opr->ndpr_ifp), e);
 				}
@@ -1856,7 +1873,8 @@ nd6_prefix_offlink(struct nd_prefix *pr)
 		/* XXX: can we still set the NDPRF_ONLINK flag? */
 		nd6log(LOG_ERR, "failed to delete route: "
 		    "%s/%d on %s (errno = %d)\n",
-		    ip6_sprintf(&sa6.sin6_addr), pr->ndpr_plen, if_name(ifp),
+		    ip6_sprintf(ip6buf, &sa6.sin6_addr), pr->ndpr_plen,
+		    if_name(ifp),
 		    error);
 	}
 
@@ -1875,6 +1893,7 @@ in6_ifadd(struct nd_prefixctl *prc, int mcast, struct psref *psref)
 	int prefixlen = prc->ndprc_plen;
 	int updateflags;
 	int s;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	ND6_ASSERT_WLOCK();
 
@@ -1973,7 +1992,7 @@ in6_ifadd(struct nd_prefixctl *prc, int mcast, struct psref *psref)
 	if (in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr) != NULL) {
 		/* this should be rare enough to make an explicit log */
 		log(LOG_INFO, "in6_ifadd: %s is already configured\n",
-		    ip6_sprintf(&ifra.ifra_addr.sin6_addr));
+		    ip6_sprintf(ip6buf, &ifra.ifra_addr.sin6_addr));
 		pserialize_read_exit(s);
 		return (NULL);
 	}
@@ -1990,7 +2009,7 @@ in6_ifadd(struct nd_prefixctl *prc, int mcast, struct psref *psref)
 		updateflags |= IN6_IFAUPDATE_DADDELAY;
 	if ((error = in6_update_ifa(ifp, &ifra, updateflags)) != 0) {
 		nd6log(LOG_ERR, "failed to make ifaddr %s on %s (errno=%d)\n",
-		    ip6_sprintf(&ifra.ifra_addr.sin6_addr), if_name(ifp),
+		    ip6_sprintf(ip6buf, &ifra.ifra_addr.sin6_addr), if_name(ifp),
 		    error);
 		return (NULL);	/* ifaddr must not have been allocated. */
 	}
diff --git a/sys/netinet6/scope6.c b/sys/netinet6/scope6.c
index 9a41abe91fdd..acbdf8b8e565 100644
--- a/sys/netinet6/scope6.c
+++ b/sys/netinet6/scope6.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: scope6.c,v 1.15 2016/08/12 11:44:24 christos Exp $	*/
+/*	$NetBSD: scope6.c,v 1.16 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$KAME$	*/
 
 /*-
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: scope6.c,v 1.15 2016/08/12 11:44:24 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: scope6.c,v 1.16 2017/01/16 07:33:36 ryo Exp $");
 
 #include <sys/param.h>
 #include <sys/malloc.h>
@@ -343,11 +343,12 @@ int
 sa6_recoverscope(struct sockaddr_in6 *sin6)
 {
 	uint32_t zoneid;
+	char ip6buf[INET6_ADDRSTRLEN];
 
 	if (sin6->sin6_scope_id != 0) {
 		log(LOG_NOTICE,
 		    "sa6_recoverscope: assumption failure (non 0 ID): %s%%%d\n",
-		    ip6_sprintf(&sin6->sin6_addr), sin6->sin6_scope_id);
+		    ip6_sprintf(ip6buf, &sin6->sin6_addr), sin6->sin6_scope_id);
 		/* XXX: proceed anyway... */
 	}
 	if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr) ||
diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 54be2c61c7bb..f02680013ff7 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec.c,v 1.67 2016/12/08 05:16:34 ozaki-r Exp $	*/
+/*	$NetBSD: ipsec.c,v 1.68 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $	*/
 /*	$KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $	*/
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.67 2016/12/08 05:16:34 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.68 2017/01/16 07:33:36 ryo Exp $");
 
 /*
  * IPsec controller part.
@@ -2313,6 +2313,10 @@ inet_ntoa4(struct in_addr ina)
 const char *
 ipsec_address(const union sockaddr_union *sa)
 {
+#if INET6
+	static char ip6buf[INET6_ADDRSTRLEN];	/* XXX: NOMPSAFE */
+#endif
+
 	switch (sa->sa.sa_family) {
 #if INET
 	case AF_INET:
@@ -2321,7 +2325,7 @@ ipsec_address(const union sockaddr_union *sa)
 
 #if INET6
 	case AF_INET6:
-		return ip6_sprintf(&sa->sin6.sin6_addr);
+		return ip6_sprintf(ip6buf, &sa->sin6.sin6_addr);
 #endif /* INET6 */
 
 	default:
diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index b49dccf6dd60..0c4764eebf81 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_input.c,v 1.36 2016/06/10 13:31:44 ozaki-r Exp $	*/
+/*	$NetBSD: ipsec_input.c,v 1.37 2017/01/16 07:33:36 ryo Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $	*/
 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.36 2016/06/10 13:31:44 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.37 2017/01/16 07:33:36 ryo Exp $");
 
 /*
  * IPsec input processing.
@@ -380,10 +380,11 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
 			saidx->proxy.sa.sa_family != 0)) {
 
+			char ip6buf[INET6_ADDRSTRLEN];
 			DPRINTF(("ipsec4_common_input_cb: inner "
 			    "source address %s doesn't correspond to "
 			    "expected proxy source %s, SA %s/%08lx\n",
-			    ip6_sprintf(&ip6n.ip6_src),
+			    ip6_sprintf(ip6buf, &ip6n.ip6_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
@@ -697,10 +698,11 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int proto
 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
 			saidx->proxy.sa.sa_family != 0)) {
 
+			char ip6buf[INET6_ADDRSTRLEN];
 			DPRINTF(("ipsec6_common_input_cb: inner "
 			    "source address %s doesn't correspond to "
 			    "expected proxy source %s, SA %s/%08lx\n",
-			    ip6_sprintf(&ip6n.ip6_src),
+			    ip6_sprintf(ip6buf, &ip6n.ip6_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));