1) icmpv6_send() and icmpv6_echo_reply() never release dst.
2) ip6_{push,flush}_pending_frames() leak np->cork.rt.