diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index 6dc8811f1733..cc9159dc85b6 100644
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_icmp.c,v 1.95 2005/08/19 12:29:18 christos Exp $	*/
+/*	$NetBSD: ip_icmp.c,v 1.96 2005/10/23 18:38:53 christos Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -101,7 +101,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.95 2005/08/19 12:29:18 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.96 2005/10/23 18:38:53 christos Exp $");
 
 #include "opt_ipsec.h"
 
@@ -226,7 +226,7 @@ icmp_mtudisc_callback_register(void (*func)(struct in_addr))
  */
 void
 icmp_error(struct mbuf *n, int type, int code, n_long dest,
-    struct ifnet *destifp)
+    int destmtu)
 {
 	struct ip *oip = mtod(n, struct ip *), *nip;
 	unsigned oiplen = oip->ip_hl << 2;
@@ -327,8 +327,8 @@ icmp_error(struct mbuf *n, int type, int code, n_long dest,
 			icp->icmp_pptr = code;
 			code = 0;
 		} else if (type == ICMP_UNREACH &&
-		    code == ICMP_UNREACH_NEEDFRAG && destifp)
-			icp->icmp_nextmtu = htons(destifp->if_mtu);
+		    code == ICMP_UNREACH_NEEDFRAG && destmtu)
+			icp->icmp_nextmtu = htons(destmtu);
 	}
 
 	icp->icmp_code = code;
diff --git a/sys/netinet/ip_icmp.h b/sys/netinet/ip_icmp.h
index c528cfa86069..fb089df84914 100644
--- a/sys/netinet/ip_icmp.h
+++ b/sys/netinet/ip_icmp.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_icmp.h,v 1.20 2004/04/21 17:49:46 itojun Exp $	*/
+/*	$NetBSD: ip_icmp.h,v 1.21 2005/10/23 18:38:53 christos Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1993
@@ -175,7 +175,7 @@ struct icmp {
 	(type) == ICMP_MASKREQ || (type) == ICMP_MASKREPLY)
 
 #ifdef _KERNEL
-void	icmp_error(struct mbuf *, int, int, n_long, struct ifnet *);
+void	icmp_error(struct mbuf *, int, int, n_long, int);
 void	icmp_mtudisc(struct icmp *, struct in_addr);
 void	icmp_input(struct mbuf *, ...);
 void	icmp_init(void);
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 2bf24bb94b06..0ee613c3df3a 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_input.c,v 1.219 2005/08/05 09:21:26 elad Exp $	*/
+/*	$NetBSD: ip_input.c,v 1.220 2005/10/23 18:38:53 christos Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -98,7 +98,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.219 2005/08/05 09:21:26 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.220 2005/10/23 18:38:53 christos Exp $");
 
 #include "opt_inet.h"
 #include "opt_gateway.h"
@@ -1823,13 +1823,9 @@ ip_forward(struct mbuf *m, int srcrt)
 	struct ip *ip = mtod(m, struct ip *);
 	struct sockaddr_in *sin;
 	struct rtentry *rt;
-	int error, type = 0, code = 0;
+	int error, type = 0, code = 0, destmtu = 0;
 	struct mbuf *mcopy;
 	n_long dest;
-	struct ifnet *destifp;
-#if defined(IPSEC) || defined(FAST_IPSEC)
-	struct ifnet dummyifp;
-#endif
 
 	/*
 	 * We are now in the output path.
@@ -1943,7 +1939,6 @@ ip_forward(struct mbuf *m, int srcrt)
 	}
 	if (mcopy == NULL)
 		return;
-	destifp = NULL;
 
 	switch (error) {
 
@@ -1965,7 +1960,7 @@ ip_forward(struct mbuf *m, int srcrt)
 		code = ICMP_UNREACH_NEEDFRAG;
 #if !defined(IPSEC) && !defined(FAST_IPSEC)
 		if (ipforward_rt.ro_rt)
-			destifp = ipforward_rt.ro_rt->rt_ifp;
+			destmtu = ipforward_rt.ro_rt->rt_ifp->if_mtu;
 #else
 		/*
 		 * If the packet is routed over IPsec tunnel, tell the
@@ -1984,7 +1979,7 @@ ip_forward(struct mbuf *m, int srcrt)
 			    &ipsecerror);
 
 			if (sp == NULL)
-				destifp = ipforward_rt.ro_rt->rt_ifp;
+				destmtu = ipforward_rt.ro_rt->rt_ifp->if_mtu;
 			else {
 				/* count IPsec header size */
 				ipsechdr = ipsec4_hdrsiz(mcopy,
@@ -1993,24 +1988,18 @@ ip_forward(struct mbuf *m, int srcrt)
 				/*
 				 * find the correct route for outer IPv4
 				 * header, compute tunnel MTU.
-				 *
-				 * XXX BUG ALERT
-				 * The "dummyifp" code relies upon the fact
-				 * that icmp_error() touches only ifp->if_mtu.
 				 */
-				/*XXX*/
-				destifp = NULL;
+
 				if (sp->req != NULL
 				 && sp->req->sav != NULL
 				 && sp->req->sav->sah != NULL) {
 					ro = &sp->req->sav->sah->sa_route;
 					if (ro->ro_rt && ro->ro_rt->rt_ifp) {
-						dummyifp.if_mtu =
+						destmtu =
 						    ro->ro_rt->rt_rmx.rmx_mtu ?
 						    ro->ro_rt->rt_rmx.rmx_mtu :
 						    ro->ro_rt->rt_ifp->if_mtu;
-						dummyifp.if_mtu -= ipsechdr;
-						destifp = &dummyifp;
+						destmtu -= ipsechdr;
 					}
 				}
 
@@ -2042,7 +2031,7 @@ ip_forward(struct mbuf *m, int srcrt)
 		break;
 #endif
 	}
-	icmp_error(mcopy, type, code, dest, destifp);
+	icmp_error(mcopy, type, code, dest, destmtu);
 }
 
 void